Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,975 results · page 16 of 60
Feb 22, 2025Migration, Backup, Staging – WPvivid Backup & Migration: Arbitrary file uploadsCVE-2024-13869 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
- Product
- Migration, Backup, Staging – WPvivid Backup & Migration
- Affected
- up to 0.9.112
- What to do
- Affects up to 0.9.112. Update Migration, Backup, Staging – WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 20, 2025Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported): Unauthorized modification of data|loss of dataCVE-2024-13520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.9. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher.
- Product
- Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
- Affected
- up to 4.4.9
- What to do
- Affects up to 4.4.9. Update Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 19, 2025Small Package Quotes – Worldwide Express Edition: SQL InjectionCVE-2024-13534 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 5.2.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2025-27268 is likely a duplicate of this issue.
- Product
- Small Package Quotes – Worldwide Express Edition
- Affected
- up to 5.2.18
- What to do
- Affects up to 5.2.18. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 19, 2025Small Package Quotes – USPS Edition: SQL InjectionCVE-2024-13533 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Small Package Quotes – USPS Edition
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Small Package Quotes – USPS Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2025Small Package Quotes – For Customers of FedEx: SQL InjectionCVE-2024-13491 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 4.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Small Package Quotes – For Customers of FedEx
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update Small Package Quotes – For Customers of FedEx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 18, 2025Booking Package: Reflected Cross-Site ScriptingCVE-2024-13508 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Booking Package
- Affected
- up to 1.6.72
- What to do
- Affects up to 1.6.72. Update Booking Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 17, 2025OWL Carousel Slider: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13627 · WordPress plugins & themes · reported by WPScanMedium 4.7
The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- OWL Carousel Slider
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update OWL Carousel Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025VR-Frases (collect & share quotes): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13626 · WordPress plugins & themes · reported by WPScanHigh 7.1
The VR-Frases (collect & share quotes) WordPress plugin through 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- VR-Frases (collect & share quotes)
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update VR-Frases (collect & share quotes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025Tube Video Ads Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13625 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Tube Video Ads Lite
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Tube Video Ads Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025Track Logins: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-13608 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Track Logins
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Track Logins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2025Keep Backup Daily: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26779 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Path Traversal.This issue affects Keep Backup Daily: from n/a through <= 2.1.0.
- Product
- Keep Backup Daily
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2025Botnet Attack Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23975 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.
- Product
- Botnet Attack Blocker
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Botnet Attack Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce easy-broken-link-checker allows Reflected XSS.This issue affects URL Shortener | Conversion Tracking | AB Testing | WooCommerce: from n/a through <= 9.0.2.
- Product
- URL Shortener | Conversion Tracking | AB Testing | WooCommerce
- Affected
- up to 9.0.2
- What to do
- Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Contact Form 7 – Paystack Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23655 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crystalwebpro Contact Form 7 – Paystack Add-on cf7-paystack-add-on allows Reflected XSS.This issue affects Contact Form 7 – Paystack Add-on: from n/a through <= 1.2.3.
- Product
- Contact Form 7 – Paystack Add-on
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Contact Form 7 – Paystack Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025Chalet-Montagne.com Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12586 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Chalet-Montagne.com Tools
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Chalet-Montagne.com Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2025Small Package Quotes – Purolator Edition: SQL InjectionCVE-2024-13532 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Small Package Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Small Package Quotes – Purolator Edition
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update Small Package Quotes – Purolator Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 12, 2025Small Package Quotes – UPS Edition: SQL InjectionCVE-2024-13475 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Small Package Quotes – UPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 4.5.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Small Package Quotes – UPS Edition
- Affected
- up to 4.5.16
- What to do
- Affects up to 4.5.16. Update Small Package Quotes – UPS Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 11, 2025Stray Random Quotes: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13570 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Stray Random Quotes
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update Stray Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 11, 2025Zarinpal Paid Download: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Zarinpal Paid Download
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Zarinpal Paid Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Facilita Form Tracker: Cross-Site Request Forgery (CSRF)CVE-2025-25128 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in orlandolac Facilita Form Tracker facilita-form-tracker allows Stored XSS.This issue affects Facilita Form Tracker: from n/a through <= 1.0.
- Product
- Facilita Form Tracker
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Facilita Form Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Guten Free Options: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13492 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Guten Free Options
- Affected
- up to 0.9.5
- What to do
- Affects up to 0.9.5. Update Guten Free Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Legull: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13352 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Legull
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Legull to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orCVE-2025-24373 · WordPress plugins & themes · reported by GitHubMedium 6.3
woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orders. This vulnerability allows unauthorized users to access any PDF document from a store if they: 1. Have access to a guest document link and 2. Replace the URL variable `my-account` with `bulk`. The issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerability compromises the confidentiality of sensitive documents, affecting all stores using the plugin with the guest access option enabled. This issue has been addressed in version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Fixed in
- 4.0.0
- What to do
- Update the plugin to 4.0.0 or newer.
Feb 4, 2025Banner Garden Plugin for: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users.
- Product
- Banner Garden Plugin for
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Banner Garden Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025TransFinanz: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13332 · WordPress plugins & themes · reported by WPScanMedium 6.1
The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- TransFinanz
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update TransFinanz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025WP Dream Carousel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Dream Carousel
- Affected
- up to 1.0.1b
- What to do
- Affects up to 1.0.1b. Update WP Dream Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025JustRows free: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13330 · WordPress plugins & themes · reported by WPScanHigh 7.1
The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- JustRows free
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update JustRows free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Solidres: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13329 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Solidres
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Giga Messenger: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13328 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Giga Messenger
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Giga Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Musicbox: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13327 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Musicbox
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Musicbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025iBuildApp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13326 · WordPress plugins & themes · reported by WPScanMedium 6.1
The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- iBuildApp
- Affected
- up to 0.2.0
- What to do
- Affects up to 0.2.0. Update iBuildApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Glossy: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Glossy
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Glossy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13114 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP Projects Portfolio with Client Testimonials
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2025Widget4Call: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13099 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Widget4Call
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Widget4Call to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2025WordPress Email Newsletter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13098 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WordPress Email Newsletter
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WordPress Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2025WP Finance: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13097 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP Finance
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update WP Finance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2025Responsive iframe: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-12768 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive iframe WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive iframe
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Responsive iframe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025A5 Custom Login Page: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13226 · WordPress plugins & themes · reported by WPScanMedium 6.1
The A5 Custom Login Page WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- A5 Custom Login Page
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update A5 Custom Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025ECT Home Page Products: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13225 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ECT Home Page Products
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update ECT Home Page Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025SlideDeck 1 Lite Content Slider: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13224 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SlideDeck 1 Lite Content Slider WordPress plugin through 1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- SlideDeck 1 Lite Content Slider
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update SlideDeck 1 Lite Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Tabulate: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2024-13223 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tabulate WordPress plugin through 2.10.3 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Tabulate
- Affected
- up to 2.10.3
- What to do
- Affects up to 2.10.3. Update Tabulate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025User Messages: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13222 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- User Messages
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update User Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Fantastic ElasticSearch: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13221 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Fantastic ElasticSearch
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Fantastic ElasticSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WordPress Google Map Professional (Map In Your Language): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13220 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WordPress Google Map Professional (Map In Your Language)
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WordPress Google Map Professional (Map In Your Language) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Privacy Policy Genius: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13219 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Privacy Policy Genius
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Privacy Policy Genius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Fast Tube: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13218 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Fast Tube
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Fast Tube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WP MediaTagger: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP MediaTagger
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update WP MediaTagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WP MediaTagger: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-13101 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP MediaTagger
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update WP MediaTagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025OPSI Israel Domestic Shipments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- OPSI Israel Domestic Shipments
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update OPSI Israel Domestic Shipments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Ninja Tables: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2024-12772 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ninja Tables WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, leading to a Cross Site Scripting vulnerability.
- Product
- Ninja Tables
- Fixed in
- 5.0.17
- What to do
- Update Ninja Tables to 5.0.17 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.