Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

1,260 results · page 14 of 26

Apr 3, 2025Minimalistic Event Manager: Missing AuthorizationCVE-2025-31739 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager minimalistic-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimalistic Event Manager: from n/a through <= 1.1.1.
Product
Minimalistic Event Manager
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Minimalistic Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025CGM Event Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31462 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rzfarrell CGM Event Calendar cgm-event-calendar allows Reflected XSS.This issue affects CGM Event Calendar: from n/a through <= 0.8.5.
Product
CGM Event Calendar
Affected
up to 0.8.5
What to do
Affects up to 0.8.5. Update CGM Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Eventbee RSVP Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31838 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eventbee Eventbee RSVP Widget eventbee-rsvp-widget allows DOM-Based XSS.This issue affects Eventbee RSVP Widget: from n/a through <= 1.0.
Product
Eventbee RSVP Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update Eventbee RSVP Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Clearbit Reveal: Cross-Site Request Forgery (CSRF)CVE-2025-31785 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Clearbit Clearbit Reveal clearbit allows Cross Site Request Forgery.This issue affects Clearbit Reveal: from n/a through <= 1.0.6.
Product
Clearbit Reveal
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Clearbit Reveal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025GTM Kit: Debug Messages Revealing Unnecessary InformationCVE-2025-31001 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Debug Messages Revealing Unnecessary Information vulnerability in TLA Media GTM Kit gtm-kit allows Retrieve Embedded Sensitive Data.This issue affects GTM Kit: from n/a through <= 2.4.0.
Product
GTM Kit
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update GTM Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Event Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30794 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through <= 5.20.0.
Product
Event Tickets
Affected
up to 5.20.0
What to do
Affects up to 5.20.0. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Timeline Event History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31595 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Stored XSS.This issue affects Timeline Event History: from n/a through <= 3.2.
Product
Timeline Event History
Affected
up to 3.2
What to do
Affects up to 3.2. Update Timeline Event History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Multi Days Events and Multi Events in One Day Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-31572 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar dragon-calendar-free-version allows Cross Site Request Forgery.This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through <= 1.1.3.
Product
Multi Days Events and Multi Events in One Day Calendar
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Multi Days Events and Multi Events in One Day Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Booking for Appointments and Events Calendar – Amelia: Full Path DisclosureCVE-2025-2578 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 28, 2025Event Tickets with Ticket Scanner: Does not have CSRF check in placeCVE-2025-1762 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Event Tickets with Ticket Scanner
Fixed in
2.5.4
What to do
Update Event Tickets with Ticket Scanner to 2.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2025Simple Google Calendar Outlook Events Block Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22497 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bramwaas Simple Google Calendar Outlook Events Block Widget simple-google-icalendar-widget allows Stored XSS.This issue affects Simple Google Calendar Outlook Events Block Widget: from n/a through <= 2.5.0.
Product
Simple Google Calendar Outlook Events Block Widget
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Simple Google Calendar Outlook Events Block Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Awesome Event Booking: Cross-Site Request Forgery (CSRF)CVE-2025-22669 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Cross Site Request Forgery.This issue affects Awesome Event Booking: from n/a through <= 2.7.5.
Product
Awesome Event Booking
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update Awesome Event Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Awesome Event Booking: Missing AuthorizationCVE-2025-22668 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Event Booking: from n/a through <= 2.7.2.
Product
Awesome Event Booking
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Awesome Event Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WpEvently: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30895 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in magepeopleteam WpEvently mage-eventpress allows PHP Local File Inclusion.This issue affects WpEvently: from n/a through <= 4.2.9.
Product
WpEvently
Affected
up to 4.2.9
What to do
Affects up to 4.2.9. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WpEvently: Missing AuthorizationCVE-2025-30887 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 4.2.9.
Product
WpEvently
Affected
up to 4.2.9
What to do
Affects up to 4.2.9. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Themify Event Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30832 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows DOM-Based XSS.This issue affects Themify Event Post: from n/a through <= 1.3.2.
Product
Themify Event Post
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Themify Event Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Themify Event Post: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30831 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Event Post themify-event-post allows PHP Local File Inclusion.This issue affects Themify Event Post: from n/a through <= 1.3.2.
Product
Themify Event Post
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Themify Event Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025WP Event Ticketing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28899 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toddhuish WP Event Ticketing wpeventticketing allows Reflected XSS.This issue affects WP Event Ticketing: from n/a through <= 1.3.4.
Product
WP Event Ticketing
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update WP Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26923 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.8.
Product
Event post
Affected
up to 5.9.8
What to do
Affects up to 5.9.8. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Another Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26536 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yendif Player Another Events Calendar another-events-calendar allows Reflected XSS.This issue affects Another Events Calendar: from n/a through <= 1.7.0.
Product
Another Events Calendar
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Another Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Event post: Stored Cross-Site ScriptingCVE-2025-2167 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Event post
Affected
up to 5.9.9
What to do
Affects up to 5.9.9. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 25, 2025Registrations for the Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-10703 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Registrations for the Events Calendar
Fixed in
2.13.4
What to do
Update Registrations for the Events Calendar to 2.13.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2025-1770 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.24
What to do
Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized modification of dataCVE-2025-1766 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.24
What to do
Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 16, 2025Download Manager: Doesn't prevent directory listing on web servers that don't use htaccessCVE-2024-13126 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
Product
Download Manager
Fixed in
3.3.07
What to do
Update Download Manager to 3.3.07 or newer.
Full record and what to do →NVD record wpscan.com
Mar 7, 2025Eventer - WordPress Event & Booking Manager: SQL InjectionCVE-2025-0959 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Eventer - WordPress Event & Booking Manager
Affected
up to 3.9.9.2
What to do
Affects up to 3.9.9.2. Update Eventer - WordPress Event & Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 6, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-13526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download list of attendees for any event.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 4.0.7.3
What to do
Affects up to 4.0.7.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2025Admin and Site Enhancements (ASE): Retrieves client IP addresses from potentially untrusted headersCVE-2024-13685 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.
Product
Admin and Site Enhancements (ASE)
Fixed in
7.6.10
What to do
Update Admin and Site Enhancements (ASE) to 7.6.10 or newer.
Full record and what to do →NVD record wpscan.com
Mar 3, 2025Events Calendar for GeoDirectory: Deserialization of Untrusted DataCVE-2025-26967 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.
Product
Events Calendar for GeoDirectory
Affected
up to 2.3.14
What to do
Affects up to 2.3.14. Update Events Calendar for GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Events Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26586 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abelony Events Planner events-planner allows Reflected XSS.This issue affects Events Planner: from n/a through <= 1.3.10.
Product
Events Planner
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update Events Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 1, 2025Multilevel Referral Affiliate Plugin for WooCommerce: SQL InjectionCVE-2024-13750 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Multilevel Referral Affiliate Plugin for WooCommerce
Affected
up to 2.28
What to do
Affects up to 2.28. Update Multilevel Referral Affiliate Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 26, 2025Events Manager: Missing AuthorizationCVE-2025-1249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through <= 6.6.4.1.
Product
Events Manager
Affected
up to 6.6.4.1
What to do
Affects up to 6.6.4.1. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2025WP BASE Booking of Appointments, Services and Events: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12737 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP BASE Booking of Appointments, Services and Events
Fixed in
5.0.0
What to do
Update WP BASE Booking of Appointments, Services and Events to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Feb 25, 2025Eventin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26964 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.20.
Product
Eventin
Affected
up to 4.0.20
What to do
Affects up to 4.0.20. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary file upload, read, and deletionCVE-2025-1128 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
Product
Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.0.9.4
What to do
Affects up to 3.0.9.4. Update Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 24, 2025Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue: Missing AuthorizationCVE-2025-27296 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue revenueflex-easy-ads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue: from n/a through <= 1.5.
Product
Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue
Affected
up to 1.5
What to do
Affects up to 1.5. Update Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 23, 2025Eventer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22635 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Eventer eventer allows Reflected XSS.This issue affects Eventer: from n/a through < 3.9.9.
Product
Eventer
Fixed in
3.9.9
What to do
Update Eventer to 3.9.9 or newer.
Full record and what to do →NVD record patchstack.com
Feb 21, 2025Event Tickets and Registration: Unauthorized loss of dataCVE-2025-1402 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary Attendee tickets.
Product
Event Tickets and Registration
Affected
up to 5.19.1.1
What to do
Affects up to 5.19.1.1. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 21, 2025Events Calendar Made Simple – Pie Calendar: Stored Cross-Site ScriptingCVE-2025-1410 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events Calendar Made Simple – Pie Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's piecal shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Events Calendar Made Simple – Pie Calendar
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Events Calendar Made Simple – Pie Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 21, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Time-based SQL InjectionCVE-2024-11260 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 6.6.3
What to do
Affects up to 6.6.3. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025Bandsintown Events: Stored Cross-Site ScriptingCVE-2024-13802 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintown_events' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bandsintown Events
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Bandsintown Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Web Stories Enhancer – Level Up Your Web Stories: Stored Cross-Site ScriptingCVE-2024-13575 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'web_stories_enhancer' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Web Stories Enhancer – Level Up Your Web Stories
Affected
up to 1.3
What to do
Affects up to 1.3. Update Web Stories Enhancer – Level Up Your Web Stories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2025WP Event Aggregator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from n/a through <= 1.8.2.
Product
WP Event Aggregator
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update WP Event Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-13125 · WordPress plugins & themes · reported by WPScanLow 3.5
The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Everest Forms
Fixed in
3.0.8.1
What to do
Update Everest Forms to 3.0.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Feb 7, 2025Event Kikfyre: Missing AuthorizationCVE-2025-25110 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Kikfyre: from n/a through <= 2.1.8.
Product
Event Kikfyre
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Event Kikfyre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025External Video For Everybody: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25097 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kwiliarty External Video For Everybody external-video-for-everybody allows Stored XSS.This issue affects External Video For Everybody: from n/a through <= 2.1.1.
Product
External Video For Everybody
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update External Video For Everybody to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025ReverbNation Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25095 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets reverbnation-widgets allows Stored XSS.This issue affects ReverbNation Widgets: from n/a through <= 2.1.
Product
ReverbNation Widgets
Affected
up to 2.1
What to do
Affects up to 2.1. Update ReverbNation Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Eventer: Unauthorized access of dataCVE-2024-11134 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to download bookings, which contains customers' personal data.
Product
Eventer
Affected
up to 3.9.9
What to do
Affects up to 3.9.9. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 3, 2025Eventer: Unauthorized access of dataCVE-2024-11133 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function in all versions up to, and including, 3.9.9.5. This makes it possible for unauthenticated attackers to download event tickets.
Product
Eventer
Affected
up to 3.9.9.5
What to do
Affects up to 3.9.9.5. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 3, 2025Eventer: Stored Cross-Site ScriptingCVE-2024-11132 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Eventer
Affected
up to 3.9.9.4
What to do
Affects up to 3.9.9.4. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.