Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,184 results · page 19 of 64
May 15, 2025Contact Form, Survey, Quiz & Popup Form Builder: Does not sanitise and escape some parametersCVE-2024-10504 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- Contact Form, Survey, Quiz & Popup Form Builder
- Fixed in
- 1.7.1
- What to do
- Update Contact Form, Survey, Quiz & Popup Form Builder to 1.7.1 or newer.
May 15, 2025Responsive Contact Form Builder & Lead Generation: Does not sanitise and escape some of its settingsCVE-2024-10475 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Responsive Contact Form Builder & Lead Generation
- Fixed in
- 1.9.8
- What to do
- Update Responsive Contact Form Builder & Lead Generation to 1.9.8 or newer.
May 15, 2025Social Media Share Buttons & Social Sharing Icons: Does not sanitize and escape some of its settingsCVE-2024-10362 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Media Share Buttons & Social Sharing Icons
- Fixed in
- 2.9.1
- What to do
- Update Social Media Share Buttons & Social Sharing Icons to 2.9.1 or newer.
May 15, 2025Social Slider Feed: Does not sanitise and escape some of its settingsCVE-2024-10149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Social Slider Feed
- Fixed in
- 2.2.9
- What to do
- Update Social Slider Feed to 2.2.9 or newer.
May 15, 2025Hubbub Lite: Does not sanitise and escape some of its settingsCVE-2024-10145 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Hubbub Lite
- Fixed in
- 1.34.4
- What to do
- Update Hubbub Lite to 1.34.4 or newer.
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-10144 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.22
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
May 15, 2025MB Custom Post Types & Custom Taxonomies: Does not sanitise and escape some of its settingsCVE-2024-10143 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MB Custom Post Types & Custom Taxonomies
- Fixed in
- 2.7.7
- What to do
- Update MB Custom Post Types & Custom Taxonomies to 2.7.7 or newer.
May 15, 2025Giveaways and Contests by RafflePress: Does not sanitise and escape some of its settingsCVE-2024-10107 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.12.17
- What to do
- Update Giveaways and Contests by RafflePress to 1.12.17 or newer.
May 15, 2025Happyforms: Does not sanitise and escape some of its settingsCVE-2024-10054 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Happyforms
- Fixed in
- 1.26.3
- What to do
- Update Happyforms to 1.26.3 or newer.
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10009 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Melapress File Monitor
- Fixed in
- 2.1.0
- What to do
- Update Melapress File Monitor to 2.1.0 or newer.
May 15, 2025coreActivity: Activity Logging for: Does not escape some request dataCVE-2024-0852 · WordPress plugins & themes · reported by WPScanHigh 8.8
The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin
- Product
- coreActivity: Activity Logging for
- Fixed in
- 1.8.1
- What to do
- Update coreActivity: Activity Logging for to 1.8.1 or newer.
May 15, 2025Advanced Schedule Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0249 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.
- Product
- Advanced Schedule Posts
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Advanced Schedule Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025illi Link Party!: Does not sanitize and escape some parametersCVE-2023-7230 · WordPress plugins & themes · reported by WPScanMedium 6.1
The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025illi Link Party!: Does not sanitise and escape some parametersCVE-2023-7228 · WordPress plugins & themes · reported by WPScanMedium 6.1
The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site Scripting attacks.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Better Follow Button for Jetpack: Does not sanitise and escape some of its settingsCVE-2023-7168 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Better Follow Button for Jetpack
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Better Follow Button for Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WolfNet IDX for: Does not sanitise and escape some of its settingsCVE-2023-6783 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WolfNet IDX for
- Affected
- up to 1.19.1
- What to do
- Affects up to 1.19.1. Update WolfNet IDX for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Travelpayouts: All Travel Brands in One Place: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5932 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Travelpayouts: All Travel Brands in One Place
- Fixed in
- 1.1.14
- What to do
- Update Travelpayouts: All Travel Brands in One Place to 1.1.14 or newer.
May 15, 2025Advanced Page Visit Counter: Does not sanitise and escape some of its settingsCVE-2023-5529 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Page Visit Counter
- Fixed in
- 8.0.6
- What to do
- Update Advanced Page Visit Counter to 8.0.6 or newer.
May 15, 2025Responsive Lightbox & Gallery: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3742 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Lightbox & Gallery
- Fixed in
- 2.5.1
- What to do
- Update Responsive Lightbox & Gallery to 2.5.1 or newer.
May 12, 2025Firelight Lightbox: Does not prevent users with post writing capabilities from executing arbitrary JavascriptCVE-2025-3597 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free version too, making it theoretically exploitable there as well.
- Product
- Firelight Lightbox
- Fixed in
- 2.3.15
- What to do
- Update Firelight Lightbox to 2.3.15 or newer.
May 7, 2025Beacon Lead Magnets and Lead Capture: Cross-Site Request Forgery (CSRF)CVE-2025-47596 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Cross Site Request Forgery.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.8.
- Product
- Beacon Lead Magnets and Lead Capture
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Beacon Lead Magnets and Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 5, 2025Newsletter: Does not sanitise and escape some of its settingsCVE-2025-3583 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Newsletter
- Fixed in
- 8.7.1
- What to do
- Update Newsletter to 8.7.1 or newer.
May 2, 2025SureForms: Does not sanitise and escape some of its Form settingsCVE-2025-3514 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SureForms
- Fixed in
- 1.4.4
- What to do
- Update SureForms to 1.4.4 or newer.
May 2, 2025SureForms: Does not sanitise and escape some of its Form settingsCVE-2025-3513 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SureForms
- Fixed in
- 1.4.4
- What to do
- Update SureForms to 1.4.4 or newer.
May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_secCVE-2024-13420 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
May 2, 2025Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOpCVE-2024-13419 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in varCVE-2024-13418 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the date of this disclosure and the issue, while partially patched, is still vulnerable.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3504 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3503 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3502 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-13381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.62
- What to do
- Update Calculated Fields Form to 5.2.62 or newer.
Apr 29, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-12273 · WordPress plugins & themes · reported by WPScanLow 3.5
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.62
- What to do
- Update Calculated Fields Form to 5.2.62 or newer.
Apr 28, 2025WordPress Tag, Category, and Taxonomy Manager: Does not sanitise and escape some of its Widgets settingsCVE-2025-0627 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WordPress Tag, Category, and Taxonomy Manager
- Fixed in
- 3.30.0
- What to do
- Update WordPress Tag, Category, and Taxonomy Manager to 3.30.0 or newer.
Apr 28, 2025WP-Recall: Does not sanitise and escape some of its settingsCVE-2024-9771 · WordPress plugins & themes · reported by WPScanLow 3.5
The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP-Recall
- Fixed in
- 16.26.12
- What to do
- Update WP-Recall to 16.26.12 or newer.
Apr 25, 2025Icegram Express: Does not sanitise and escape some of its Template settingsCVE-2025-0671 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Express
- Fixed in
- 5.7.50
- What to do
- Update Icegram Express to 5.7.50 or newer.
Apr 24, 2025WP-reCAPTCHA-bp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46541 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elrata_ WP-reCAPTCHA-bp wp-recaptcha-bp allows Stored XSS.This issue affects WP-reCAPTCHA-bp: from n/a through <= 4.1.
- Product
- WP-reCAPTCHA-bp
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update WP-reCAPTCHA-bp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Drop Caps: Cross-Site Request Forgery (CSRF)CVE-2025-46495 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through <= 2.1.
- Product
- Drop Caps
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Drop Caps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Capturly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39379 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Capturly Capturly capturly-optimize-your-website allows PHP Local File Inclusion.This issue affects Capturly: from n/a through <= 2.0.1.
- Product
- Capturly
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Capturly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Category Posts Widget: Does not sanitise and escape some of its settingsCVE-2025-1453 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Category Posts Widget
- Fixed in
- 4.9.20
- What to do
- Update Category Posts Widget to 4.9.20 or newer.
Apr 22, 2025Front End Users: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13569 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Front End Users
- Affected
- up to 3.2.32
- What to do
- Affects up to 3.2.32. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2025-2162 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MapPress Maps for
- Fixed in
- 2.94.10
- What to do
- Update MapPress Maps for to 2.94.10 or newer.
Apr 17, 2025Beacon Lead Magnets and Lead Capture: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24637 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Reflected XSS.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.7.
- Product
- Beacon Lead Magnets and Lead Capture
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Beacon Lead Magnets and Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1525 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ultimate Dashboard
- Fixed in
- 3.8.6
- What to do
- Update Ultimate Dashboard to 3.8.6 or newer.
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1524 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ultimate Dashboard
- Fixed in
- 3.8.6
- What to do
- Update Ultimate Dashboard to 3.8.6 or newer.
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1523 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ultimate Dashboard
- Fixed in
- 3.8.6
- What to do
- Update Ultimate Dashboard to 3.8.6 or newer.
Apr 17, 2025Icegram Express formerly known as Email Subscribers: Does not sanitise and escape some of its settingsCVE-2024-11924 · WordPress plugins & themes · reported by WPScanLow 3.5
The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Express formerly known as Email Subscribers
- Fixed in
- 5.7.52
- What to do
- Update Icegram Express formerly known as Email Subscribers to 5.7.52 or newer.
Apr 16, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10680 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.32
- What to do
- Update Form Maker by 10Web to 1.15.32 or newer.
Apr 15, 2025Simple Social Media Share Buttons: Does not sanitise and escape some of its settingsCVE-2024-13610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Social Media Share Buttons
- Fixed in
- 6.0.0
- What to do
- Update Simple Social Media Share Buttons to 6.0.0 or newer.
Apr 15, 2025Widget for Social Page Feeds: Does not sanitise and escape some of its settingsCVE-2024-13207 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Widget for Social Page Feeds
- Fixed in
- 6.4.2
- What to do
- Update Widget for Social Page Feeds to 6.4.2 or newer.
Apr 14, 2025PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its settingsCVE-2024-9230 · WordPress plugins & themes · reported by WPScanMedium 5.9
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks
- Product
- PowerPress Podcasting plugin by Blubrry
- Fixed in
- 11.9.18
- What to do
- Update PowerPress Podcasting plugin by Blubrry to 11.9.18 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.