Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,975 results · page 13 of 60
May 15, 2025ProfilePro: Does not sanitise and escape some parameters and lacks proper access controlsCVE-2024-6668 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks
- Product
- ProfilePro
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ProfilePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025KBucket: Your Curated Content in: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6667 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin.
- Product
- KBucket: Your Curated Content in
- Fixed in
- 4.1.5
- What to do
- Update KBucket: Your Curated Content in to 4.1.5 or newer.
May 15, 2025Tracking Code Manager: Does not sanitise and escape some of its settingsCVE-2024-6335 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Tracking Code Manager
- Fixed in
- 2.3.0
- What to do
- Update Tracking Code Manager to 2.3.0 or newer.
May 15, 2025If-So Dynamic Content Personalization: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5440 · WordPress plugins & themes · reported by WPScanMedium 5.4
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- If-So Dynamic Content Personalization
- Fixed in
- 1.8.0.3
- What to do
- Update If-So Dynamic Content Personalization to 1.8.0.3 or newer.
May 15, 2025S3Player: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13865 · WordPress plugins & themes · reported by WPScanMedium 6.1
The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- S3Player
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update S3Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Badgearoo: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13828 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Badgearoo
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Badgearoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025360 Product Rotation: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13823 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- 360 Product Rotation
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update 360 Product Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025MemberSpace: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13727 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- MemberSpace
- Fixed in
- 2.1.14
- What to do
- Update MemberSpace to 2.1.14 or newer.
May 15, 2025LifterLMS: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13619 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- LifterLMS
- Fixed in
- 8.0.1
- What to do
- Update LifterLMS to 8.0.1 or newer.
May 15, 2025Custom Field Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12873 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Custom Field Manager
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Custom Field Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private postsCVE-2024-12767 · WordPress plugins & themes · reported by WPScanLow 3.5
The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts
- Product
- buddyboss-platform
- Fixed in
- 2.7.60
- What to do
- Update buddyboss-platform to 2.7.60 or newer.
May 15, 2025Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12734 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025AffiliateImporterEb: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12733 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- AffiliateImporterEb
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update AffiliateImporterEb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025AffiliateImporterEb: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12732 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- AffiliateImporterEb
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update AffiliateImporterEb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025ClipArt: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12726 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ClipArt
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update ClipArt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Clasify Classified Listing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12725 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Clasify Classified Listing
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Clasify Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP DeskLite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12724 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP DeskLite
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP DeskLite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Twitter Bootstrap Collapse aka Accordian Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-12722 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Twitter Bootstrap Collapse aka Accordian Shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Twitter Bootstrap Collapse aka Accordian Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Planning Center Online Giving: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11502 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Planning Center Online Giving
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Planning Center Online Giving to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Full Screen (Page) Background Image Slideshow: Does not sanitise and escape some of its settingsCVE-2024-11221 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Full Screen (Page) Background Image Slideshow
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Full Screen (Page) Background Image Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025JSFiddle Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10818 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JSFiddle Shortcode WordPress plugin before 1.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- JSFiddle Shortcode
- Fixed in
- 1.1.3
- What to do
- Update JSFiddle Shortcode to 1.1.3 or newer.
May 15, 2025Countdown Timer for WordPress Block Editor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-10631 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Countdown Timer for WordPress Block Editor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Countdown Timer for WordPress Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Jetpack WordPress plugin before 13.8, Jetpack Boost: Use regexes in the Site Accelerator featuresCVE-2024-10076 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks
- Product
- Jetpack WordPress plugin before 13.8, Jetpack Boost
- Fixed in
- 13.8
- What to do
- Update Jetpack WordPress plugin before 13.8, Jetpack Boost to 13.8 or newer.
May 15, 2025Jetpack: Does not ensure that the post created by the Contact Form is only accessible to authorised usersCVE-2024-10075 · WordPress plugins & themes · reported by WPScanMedium 5.6
The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.
- Product
- Jetpack
- Fixed in
- 13.8
- What to do
- Update Jetpack to 13.8 or newer.
May 15, 2025This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to maniCVE-2024-0970 · WordPress plugins & themes · reported by WPScanMedium 5.3
This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
- Fixed in
- 4.1.4
- What to do
- Update the plugin to 4.1.4 or newer.
May 15, 2025Advanced Schedule Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0249 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.
- Product
- Advanced Schedule Posts
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Advanced Schedule Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025illi Link Party!: Lacks proper access controlsCVE-2023-7231 · WordPress plugins & themes · reported by WPScanHigh 7.3
The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Better Follow Button for Jetpack: Does not sanitise and escape some of its settingsCVE-2023-7168 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Better Follow Button for Jetpack
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Better Follow Button for Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Travelpayouts: All Travel Brands in One Place: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5932 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Travelpayouts: All Travel Brands in One Place
- Fixed in
- 1.1.14
- What to do
- Update Travelpayouts: All Travel Brands in One Place to 1.1.14 or newer.
May 15, 2025Jetpack Debug Tools: Missing AuthorizationCVE-2024-56006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1.
- Product
- Jetpack Debug Tools
- Fixed in
- 2.0.1
- What to do
- Update Jetpack Debug Tools to 2.0.1 or newer.
May 15, 2025Responsive Lightbox & Gallery: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3742 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Lightbox & Gallery
- Fixed in
- 2.5.1
- What to do
- Update Responsive Lightbox & Gallery to 2.5.1 or newer.
May 7, 2025Awin – Advertiser Tracking for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-47633 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Awin Awin – Advertiser Tracking for WooCommerce awin-advertiser-tracking allows Cross Site Request Forgery.This issue affects Awin – Advertiser Tracking for WooCommerce: from n/a through <= 2.0.0.
- Product
- Awin – Advertiser Tracking for WooCommerce
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Awin – Advertiser Tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Submission DOM tracking for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47626 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Submission DOM tracking for Contact Form 7 cf7-submission-dom-tracking allows Stored XSS.This issue affects Submission DOM tracking for Contact Form 7: from n/a through <= 2.1.
- Product
- Submission DOM tracking for Contact Form 7
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Submission DOM tracking for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Cart tracking for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47538 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce cart-tracking-for-woocommerce allows SQL Injection.This issue affects Cart tracking for WooCommerce: from n/a through <= 1.0.17.
- Product
- Cart tracking for WooCommerce
- Affected
- up to 1.0.17
- What to do
- Affects up to 1.0.17. Update Cart tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025TrackShip for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47460 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TrackShip TrackShip for WooCommerce trackship-for-woocommerce allows SQL Injection.This issue affects TrackShip for WooCommerce: from n/a through <= 1.9.1.
- Product
- TrackShip for WooCommerce
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update TrackShip for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites
- Affected
- up to 5.10.29
- What to do
- Affects up to 5.10.29. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 24, 2025Hacklog Remote Attachment: Cross-Site Request Forgery (CSRF)CVE-2025-46530 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Attachment hacklog-remote-attachment allows Stored XSS.This issue affects Hacklog Remote Attachment: from n/a through <= 1.3.2.
- Product
- Hacklog Remote Attachment
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Hacklog Remote Attachment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46472 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.6.
- Product
- The Pack Elementor addons
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025Front End Users: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13569 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Front End Users
- Affected
- up to 3.2.32
- What to do
- Affects up to 3.2.32. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 19, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1457 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Wrapper Link, Countdown and Gallery widgets in all versions up to, and including, 5.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites
- Affected
- up to 5.10.28
- What to do
- Affects up to 5.10.28. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 202517TRACK for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27324 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 17track 17TRACK for WooCommerce 17track allows Reflected XSS.This issue affects 17TRACK for WooCommerce: from n/a through <= 1.2.10.
- Product
- 17TRACK for WooCommerce
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update 17TRACK for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Shipmozo Courier Tracking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27293 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webparexapp Shipmozo Courier Tracking webparex allows Reflected XSS.This issue affects Shipmozo Courier Tracking: from n/a through <= 1.0.
- Product
- Shipmozo Courier Tracking
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Shipmozo Courier Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WordPress Backup & Migration: Insertion of Sensitive Information into Log FileCVE-2025-24651 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Retrieve Embedded Sensitive Data.This issue affects WordPress Backup & Migration: from n/a through <= 1.5.3.
- Product
- WordPress Backup & Migration
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Shipment Tracker for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24586 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bitsstech Shipment Tracker for Woocommerce shipment-tracker-for-woocommerce allows Reflected XSS.This issue affects Shipment Tracker for Woocommerce: from n/a through <= 1.4.23.
- Product
- Shipment Tracker for Woocommerce
- Affected
- up to 1.4.23
- What to do
- Affects up to 1.4.23. Update Shipment Tracker for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Editor Wysiwyg Background Color: Missing AuthorizationCVE-2025-23958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FADI MED Editor Wysiwyg Background Color editor-wysiwyg-background-color allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Wysiwyg Background Color: from n/a through <= 1.0.
- Product
- Editor Wysiwyg Background Color
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Editor Wysiwyg Background Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Klarna Checkout for WooCommerce: Exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per requestCVE-2024-13925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.
- Product
- Klarna Checkout for WooCommerce
- Fixed in
- 2.13.5
- What to do
- Update Klarna Checkout for WooCommerce to 2.13.5 or newer.
Apr 16, 2025Slazzer Background Changer: Missing AuthorizationCVE-2025-39531 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in slazzercom Slazzer Background Changer slazzer-background-changer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slazzer Background Changer: from n/a through <= 3.14.
- Product
- Slazzer Background Changer
- Affected
- up to 3.14
- What to do
- Affects up to 3.14. Update Slazzer Background Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025WP STAGING Pro WordPress Backup: Information ExposureCVE-2025-3104 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plugins.
- Product
- WP STAGING Pro WordPress Backup
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update WP STAGING Pro WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwp-staging.comwordfence.com
Apr 11, 2025AnyTrack Affiliate Link Manager: Missing AuthorizationCVE-2025-31041 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.0.4.
- Product
- AnyTrack Affiliate Link Manager
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update AnyTrack Affiliate Link Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Feedify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13874 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Feedify
- Fixed in
- 2.4.6
- What to do
- Update Feedify to 2.4.6 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.