Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,183 results · page 15 of 64
Nov 20, 2025attention-bar: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-12502 · WordPress plugins & themes · reported by WPScanMedium 6.8
The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users such as administrator to perform SQL injection attacks
- Product
- attention-bar
- Affected
- up to 0.7.2.1
- What to do
- Affects up to 0.7.2.1. Update attention-bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2025Team Members Showcase: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-11560 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins.
- Product
- Team Members Showcase
- Fixed in
- 3.5.0
- What to do
- Update Team Members Showcase to 3.5.0 or newer.
Nov 4, 2025Simple User Capabilities: Privilege EscalationCVE-2025-12158 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.
- Product
- Simple User Capabilities
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple User Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Nov 4, 2025Simple User Capabilities: Unauthorized modification of dataCVE-2025-12157 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_reset_capability' AJAX endpoint in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to reset any user's capabilities.
- Product
- Simple User Capabilities
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple User Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Oct 31, 2025OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA): IP Header SpoofingCVE-2025-12094 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers (such as CF-Connecting-IP, X-Forwarded-For, and others) without verifying that those headers originate from legitimate, trusted proxies. This makes it possible for unauthenticated attackers to spoof their IP address and bypass IP-based security controls, including blocked IP lists and rate limiting protections, by sending arbitrary HTTP headers with their requests.
- Product
- OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)
- Affected
- up to 1.2.53
- What to do
- Affects up to 1.2.53. Update OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2025NS Maintenance Mode for WP: Does not sanitise and escape some of its settingsCVE-2025-10636 · WordPress plugins & themes · reported by WPScanLow 3.5
The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- NS Maintenance Mode for WP
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update NS Maintenance Mode for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Doppler Forms: Registers an AJAX action install_extension without verifying user capabilities or using a nonceCVE-2025-9544 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).
- Product
- Doppler Forms
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Captivate Sync: Deserialization of Untrusted DataCVE-2025-60221 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Object Injection.This issue affects Captivate Sync: from n/a through <= 3.0.3.
- Product
- Captivate Sync
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Scape: Deserialization of Untrusted DataCVE-2025-60213 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Whitebox-Studio Scape scape allows Object Injection.This issue affects Scape: from n/a through <= 1.5.13.
- Product
- Scape
- Affected
- up to 1.5.13
- What to do
- Affects up to 1.5.13. Update Scape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Captcha.eu: Server-Side Request Forgery (SSRF)CVE-2025-49374 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in captcha.eu Captcha.eu captcha-eu allows Server Side Request Forgery.This issue affects Captcha.eu: from n/a through <= 1.0.61.
- Product
- Captcha.eu
- Affected
- up to 1.0.61
- What to do
- Affects up to 1.0.61. Update Captcha.eu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2025Simple SEO: Does not sanitise and escape some parametersCVE-2025-10357 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple SEO WordPress plugin before 2.0.32 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- Simple SEO
- Fixed in
- 2.0.32
- What to do
- Update Simple SEO to 2.0.32 or newer.
Oct 8, 2025Find Me On: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-10635 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks
- Product
- Find Me On
- Affected
- up to 2.0.9.1
- What to do
- Affects up to 2.0.9.1. Update Find Me On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2025Ajax WooSearch: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9697 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Ajax WooSearch
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ajax WooSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2025CTL Behance Importer Lite: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9587 · WordPress plugins & themes · reported by WPScanHigh 8.6
The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- CTL Behance Importer Lite
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CTL Behance Importer Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 29, 2025Postie: Does not sanitise and escape some of its settingsCVE-2024-5200 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Postie
- Fixed in
- 1.9.71
- What to do
- Update Postie to 1.9.71 or newer.
Sep 26, 2025Recaptcha – wp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60177 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rozx Recaptcha – wp recaptcha-wp allows Stored XSS.This issue affects Recaptcha – wp: from n/a through <= 0.2.6.
- Product
- Recaptcha – wp
- Affected
- up to 0.2.6
- What to do
- Affects up to 0.2.6. Update Recaptcha – wp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2025SureForms: Does not sanitise and escape some parametersCVE-2025-8282 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks.
- Product
- SureForms
- Fixed in
- 1.9.1
- What to do
- Update SureForms to 1.9.1 or newer.
Sep 22, 2025Etsy Shop: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-9115 · WordPress plugins & themes · reported by WPScanMedium 5.6
The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- Etsy Shop
- Fixed in
- 3.0.7
- What to do
- Update Etsy Shop to 3.0.7 or newer.
Sep 12, 2025Contact Form 7 reCAPTCHA: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-8280 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- Contact Form 7 reCAPTCHA
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Contact Form 7 reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025AI ChatBot for WordPress: Does not sanitise and escape some of its settingsCVE-2025-9111 · WordPress plugins & themes · reported by WPScanLow 3.5
The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AI ChatBot for WordPress
- Fixed in
- 7.1.0
- What to do
- Update AI ChatBot for WordPress to 7.1.0 or newer.
Sep 5, 2025OceanWP: Is vulnerable to an option update due to a missing capability check on one of its AJAX request handlerCVE-2025-8944 · WordPress plugins & themes · reported by WPScanMedium 4.3
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
- Product
- OceanWP
- Fixed in
- 4.1.2
- What to do
- Update OceanWP to 4.1.2 or newer.
Sep 3, 2025Sticky Side Buttons: Does not sanitise and escape some of its settingsCVE-2023-3666 · WordPress plugins & themes · reported by WPScanLow 3.3
The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Sticky Side Buttons
- Fixed in
- 2.0.0
- What to do
- Update Sticky Side Buttons to 2.0.0 or newer.
Aug 28, 2025Captcha.eu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53579 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu captcha-eu allows Reflected XSS.This issue affects Captcha.eu: from n/a through < 1.0.61.
- Product
- Captcha.eu
- What to do
- Update Captcha.eu to the newest version.
Aug 28, 2025Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpreCVE-2025-0951 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
Aug 22, 2025WP Talroo: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-8281 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin and unauthenticated users.
- Product
- WP Talroo
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update WP Talroo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Comments Capcha Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53226 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Comments Capcha Box comments-capcha-box allows Reflected XSS.This issue affects Comments Capcha Box: from n/a through <= 1.1.
- Product
- Comments Capcha Box
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Comments Capcha Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2025Ebook Store: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-8113 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- Ebook Store
- Fixed in
- 5.8015
- What to do
- Update Ebook Store to 5.8015 or newer.
Aug 15, 2025Alobaidi Captcha: Stored Cross-Site ScriptingCVE-2025-8080 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Alobaidi Captcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Alobaidi Captcha
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Alobaidi Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025CaptionPix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52788 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson CaptionPix captionpix allows Reflected XSS.This issue affects CaptionPix: from n/a through <= 1.8.
- Product
- CaptionPix
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update CaptionPix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Lead Capturing Pages: Missing AuthorizationCVE-2025-31425 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.
- Product
- WP Lead Capturing Pages
- What to do
- Update WP Lead Capturing Pages to the newest version.
Aug 14, 2025Injection Guard: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-8046 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- Injection Guard
- Fixed in
- 1.2.8
- What to do
- Update Injection Guard to 1.2.8 or newer.
Aug 14, 2025WP Shopify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-7808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Shopify
- Fixed in
- 1.5.4
- What to do
- Update WP Shopify to 1.5.4 or newer.
Aug 14, 2025Structured Content (JSON-LD) #wpsc: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-3414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Structured Content (JSON-LD) #wpsc
- Fixed in
- 1.7.0
- What to do
- Update Structured Content (JSON-LD) #wpsc to 1.7.0 or newer.
Aug 8, 2025OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-6572 · WordPress plugins & themes · reported by WPScanMedium 5.9
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2025SureForms: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-5921 · WordPress plugins & themes · reported by WPScanMedium 5.8
The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.
- Product
- SureForms
- Fixed in
- 1.7.2
- What to do
- Update SureForms to 1.7.2 or newer.
Jul 25, 2025My Reservation System: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-7022 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- My Reservation System
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update My Reservation System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2025Qwizcards | online quizzes and flashcards: Does not sanitise and escape the "_stylesheet" parameter before outputting it back in the pageCVE-2025-6174 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user.
- Product
- Qwizcards | online quizzes and flashcards
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update Qwizcards | online quizzes and flashcards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2025GeoDirectory: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-6200 · WordPress plugins & themes · reported by WPScanMedium 5.9
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GeoDirectory
- Fixed in
- 2.8.120
- What to do
- Update GeoDirectory to 2.8.120 or newer.
Jul 10, 2025Hostel: Does not sanitise and escape some of its settingsCVE-2025-6236 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Hostel
- Fixed in
- 1.1.5.9
- What to do
- Update Hostel to 1.1.5.9 or newer.
Jul 10, 2025Hostel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-6234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Hostel
- Fixed in
- 1.1.5.8
- What to do
- Update Hostel to 1.1.5.8 or newer.
Jul 4, 2025Contact Form 7 reCAPTCHA: Cross-Site Request Forgery (CSRF)CVE-2025-23972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brian S. Reed Contact Form 7 reCAPTCHA contact-form-7-recaptcha allows Cross Site Request Forgery.This issue affects Contact Form 7 reCAPTCHA: from n/a through <= 1.2.0.
- Product
- Contact Form 7 reCAPTCHA
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Contact Form 7 reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 30, 2025Contact Form: Does not sanitise and escape some of its settingsCVE-2025-5730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Contact Form
- Fixed in
- 1.1.29
- What to do
- Update Contact Form to 1.1.29 or newer.
Jun 27, 2025WP Map Block: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-5194 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Map Block
- Fixed in
- 2.0.3
- What to do
- Update WP Map Block to 2.0.3 or newer.
Jun 27, 2025Firelight Lightbox: Does not sanitise and escape title attributes before outputting them in the pageCVE-2025-5035 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
- Product
- Firelight Lightbox
- Fixed in
- 2.3.16
- What to do
- Update Firelight Lightbox to 2.3.16 or newer.
Jun 21, 2025wp-file-download: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-5034 · WordPress plugins & themes · reported by WPScanHigh 7.1
The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- wp-file-download
- Fixed in
- 6.2.6
- What to do
- Update wp-file-download to 6.2.6 or newer.
Jun 20, 2025User Roles and Capabilities: Missing AuthorizationCVE-2025-49981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through <= 1.2.6.
- Product
- User Roles and Capabilities
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update User Roles and Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Ivory Search: Does not sanitise and escape some of its settingsCVE-2025-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Ivory Search
- Fixed in
- 5.5.10
- What to do
- Update Ivory Search to 5.5.10 or newer.
Jun 10, 2025inprosysmedia-likes-dislikes-post: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-4840 · WordPress plugins & themes · reported by WPScanHigh 7.5
The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- inprosysmedia-likes-dislikes-post
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update inprosysmedia-likes-dislikes-post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2025The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_CVE-2025-4387 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.
- Affected
- up to 9.16.0
- What to do
- Affects up to 9.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtychesoftwares.comtychesoftwares.com
Jun 9, 2025Backup and Staging by WP Time Capsule: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47477 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Reflected XSS.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.23.
- Product
- Backup and Staging by WP Time Capsule
- Affected
- up to 1.22.23
- What to do
- Affects up to 1.22.23. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.