Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

188 results · page 2 of 4

Dec 13, 2025Quick Testimonials: Stored Cross-Site ScriptingCVE-2025-14378 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Quick Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Quick Testimonials
Affected
up to 2.1
What to do
Affects up to 2.1. Update Quick Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 14, 2025Creta Testimonial Showcase: Is vulnerable to Local File InclusionCVE-2025-10686 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.
Product
Creta Testimonial Showcase
Fixed in
1.2.4
What to do
Update Creta Testimonial Showcase to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com
Nov 6, 2025Strong Testimonials: Arbitrary shortcode executionCVE-2025-11268 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.
Product
Strong Testimonials
Affected
up to 3.2.16
What to do
Affects up to 3.2.16. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 29, 2025Easy Testimonial Slider and Form: SQL InjectionCVE-2015-10147 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Easy Testimonial Slider and Form
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Easy Testimonial Slider and Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 26, 2025Awesome Testimonials: Cross-Site Request Forgery (CSRF)CVE-2025-62933 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Prakash Awesome Testimonials awesome-testimonials allows Stored XSS.This issue affects Awesome Testimonials: from n/a through <= 2.2.1.
Product
Awesome Testimonials
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Awesome Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Testimonial Slider: Missing AuthorizationCVE-2025-62929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.
Product
Testimonial Slider
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2025Testimonial Carousel For Elementor: Stored Cross-Site ScriptingCVE-2025-8666 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions less than, or equal to, 11.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Testimonial Carousel For Elementor
What to do
Update Testimonial Carousel For Elementor to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-62071 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.29.
Product
Social proof testimonials and reviews by Repuso
Affected
up to 5.29
What to do
Affects up to 5.29. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Testimonial Slider And Showcase Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32657 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And Showcase Pro: from n/a through <= 2.1.7.
Product
Testimonial Slider And Showcase Pro
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Testimonial Slider And Showcase Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2025Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: Insecure Direct Object ReferenceCVE-2025-11519 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to offload media that doesn't belong to them.
Product
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Sep 26, 2025Testimonial Slider: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60126 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginOps Testimonial Slider testimonial-add allows PHP Local File Inclusion.This issue affects Testimonial Slider: from n/a through <= 3.5.8.6.
Product
Testimonial Slider
Affected
up to 3.5.8.6
What to do
Affects up to 3.5.8.6. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2025Testimonial: SQL InjectionCVE-2025-7826 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Testimonial
Affected
up to 2.3
What to do
Affects up to 2.3. Update Testimonial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 20, 2025TC Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49410 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.
Product
TC Testimonials
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update TC Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 26, 2025MinimogWP – The High Converting eCommerce: Price manipulationCVE-2025-8198 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.9.0. This is due to an insufficient check on quantity values when changing quantities in the cart. This makes it possible for unauthenticated attackers to add items to the cart and adjust the quantity to a fractional amount, causing the price to change based on the fractional amount. The vulnerability cannot be exploited if WooCommerce version 9.8.2+ is installed.
Product
MinimogWP – The High Converting eCommerce
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update MinimogWP – The High Converting eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record changelog.thememove.com wordfence.com
Jul 18, 2025Testimonial Post type: Stored Cross-Site ScriptingCVE-2025-5800 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Testimonial Post type plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Testimonial Post type
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Testimonial Post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 15, 2025Strong Testimonials: Stored Cross-Site ScriptingCVE-2025-7367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and including, 3.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Strong Testimonials
Affected
up to 3.2.11
What to do
Affects up to 3.2.11. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2025Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49245 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Reflected XSS.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.
Product
Testimonials Showcase
Affected
up to 1.9.16
What to do
Affects up to 1.9.16. Update Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Testimonials Showcase: Missing AuthorizationCVE-2025-49246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.
Product
Testimonials Showcase
Affected
up to 1.9.16
What to do
Affects up to 1.9.16. Update Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025GS Testimonial Slider: Improper Control of Generation of Code ('Code Injection')CVE-2025-47481 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Generation of Code ('Code Injection') vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Code Injection.This issue affects GS Testimonial Slider: from n/a through <= 3.2.9.
Product
GS Testimonial Slider
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update GS Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025GS Testimonial Slider: Missing AuthorizationCVE-2025-47467 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Testimonial Slider: from n/a through <= 3.3.0.
Product
GS Testimonial Slider
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update GS Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Real Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22269 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Stored XSS.This issue affects Real Testimonials: from n/a through <= 3.1.6.
Product
Real Testimonials
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Real Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Testimonial Slider And Showcase Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32656 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And Showcase Pro: from n/a through <= 2.3.15.
Product
Testimonial Slider And Showcase Pro
Affected
up to 2.3.15
What to do
Affects up to 2.3.15. Update Testimonial Slider And Showcase Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025Testimonial Slider: Deserialization of Untrusted DataCVE-2025-30889 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: from n/a through <= 2.0.13.
Product
Testimonial Slider
Affected
up to 2.0.13
What to do
Affects up to 2.0.13. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-31886 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.21.
Product
Social proof testimonials and reviews by Repuso
Affected
up to 5.21
What to do
Affects up to 5.21. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Apimo Connector: Cross-Site Request Forgery (CSRF)CVE-2025-31602 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.1.
Product
Apimo Connector
Affected
up to 2.6.5.1
What to do
Affects up to 2.6.5.1. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Elfsight Testimonials Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31588 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Cross Site Request Forgery.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.
Product
Elfsight Testimonials Slider
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Elfsight Testimonials Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31587 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Stored XSS.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.
Product
Elfsight Testimonials Slider
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Elfsight Testimonials Slider: Missing AuthorizationCVE-2025-31584 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.
Product
Elfsight Testimonials Slider
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025TBTestimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26584 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Travis Ballard TBTestimonials tb-testimonials allows Reflected XSS.This issue affects TBTestimonials: from n/a through <= 1.7.3.
Product
TBTestimonials
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update TBTestimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2025MinimogWP – The High Converting eCommerce: Local File InclusionCVE-2024-13790 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.7.0 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
MinimogWP – The High Converting eCommerce
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update MinimogWP – The High Converting eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record changelog.thememove.com themeforest.net
Feb 25, 2025Strong Testimonials: Missing AuthorizationCVE-2025-26975 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Strong Testimonials: from n/a through <= 3.2.3.
Product
Strong Testimonials
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Super Testimonials: Stored Cross-Site ScriptingCVE-2024-13704 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Super Testimonials
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not have CSRF check in some placesCVE-2024-13115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
WP Projects Portfolio with Client Testimonials
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13114 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Projects Portfolio with Client Testimonials
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 30, 2025WE – Testimonial Slider: Stored Cross-Site ScriptingCVE-2024-13460 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WE – Testimonial Slider
Affected
up to 1.5
What to do
Affects up to 1.5. Update WE – Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 25, 2025Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More: Stored Cross-Site ScriptingCVE-2025-0350 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2025Kumihimo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23626 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fukushima Kumihimo kumihimo allows Reflected XSS.This issue affects Kumihimo: from n/a through <= 1.0.2.
Product
Kumihimo
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Kumihimo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Web Testimonials: Cross-Site Request Forgery (CSRF)CVE-2025-23560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through <= 1.2.
Product
Web Testimonials
Affected
up to 1.2
What to do
Affects up to 1.2. Update Web Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Social proof testimonials and reviews by Repuso: Stored Cross-Site ScriptingCVE-2024-13351 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Social proof testimonials and reviews by Repuso plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rw_image_badge1' shortcode in all versions up to, and including, 5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social proof testimonials and reviews by Repuso
Affected
up to 5.20
What to do
Affects up to 5.20. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025MIMO Woocommerce Order Tracking: Unauthorized modification of dataCVE-2024-5769 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add, update, and delete shipper tracking settings.
Product
MIMO Woocommerce Order Tracking
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update MIMO Woocommerce Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2023-46196 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 4.97.
Product
Social proof testimonials and reviews by Repuso
Affected
up to 4.97
What to do
Affects up to 4.97. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Mimoos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55974 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martí Batlles Martinez Mimoos devoluciones-packback allows SQL Injection.This issue affects Mimoos: from n/a through <= 1.2.
Product
Mimoos
Affected
up to 1.2
What to do
Affects up to 1.2. Update Mimoos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 5, 2024Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials: Local File InclusionCVE-2024-11429 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'stars-testimonials-with-slider-and-masonry-grid' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
Product
Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 4, 2024B Testimonial – testimonial plugin for WP: Stored Cross-Site ScriptingCVE-2024-11880 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
B Testimonial – testimonial plugin for WP
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update B Testimonial – testimonial plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024Tribute Testimonials – WordPress Testimonial Grid/Slider: Stored Cross-Site ScriptingCVE-2024-10886 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tribute_testimonials_slider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tribute Testimonials – WordPress Testimonial Grid/Slider
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Tribute Testimonials – WordPress Testimonial Grid/Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 19, 2024ESB Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51936 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eSparkBiz ESB Testimonials esb-testimonials allows Stored XSS.This issue affects ESB Testimonials: from n/a through <= 1.0.0.
Product
ESB Testimonials
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update ESB Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Testimonial Slider Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51925 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sazzad Testimonial Slider Shortcode testimonial-slider-shortcode allows Stored XSS.This issue affects Testimonial Slider Shortcode: from n/a through <= 1.1.9.
Product
Testimonial Slider Shortcode
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Testimonial Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Luzuk Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51872 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in luzuk Themes Luzuk Testimonials luzuk-testimonials allows Stored XSS.This issue affects Luzuk Testimonials: from n/a through <= 0.0.1.
Product
Luzuk Testimonials
Affected
up to 0.0.1
What to do
Affects up to 0.0.1. Update Luzuk Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Faltu Testimonial Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51853 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberuni Azad. Faltu Testimonial Rotator faltu-testimonial-rotator allows DOM-Based XSS.This issue affects Faltu Testimonial Rotator: from n/a through <= 1.0.0.
Product
Faltu Testimonial Rotator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Faltu Testimonial Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Awesome Fitness Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51806 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shingo Awesome Fitness Testimonials awesome-fitness-testimonials allows Stored XSS.This issue affects Awesome Fitness Testimonials: from n/a through <= 1.0.1.
Product
Awesome Fitness Testimonials
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Awesome Fitness Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.