Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,736 results · page 20 of 55

Jan 20, 2026weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation: Authorization bypassCVE-2025-14348 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the `x-wemail-user` HTTP header to identify users without verifying the request originates from an authenticated WordPress session. This makes it possible for unauthenticated attackers who know or can guess an admin email (easily enumerable via `/wp-json/wp/v2/users`) to impersonate that user and access the CSV subscriber endpoints, potentially exfiltrating subscriber PII (emails, names, phone numbers) from imported CSV files.
Product
weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 19, 2026Newsletter – Send awesome emails from: Cross-Site Request ForgeryCVE-2026-1051 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.0. This is due to missing or incorrect nonce validation on the hook_newsletter_action() function. This makes it possible for unauthenticated attackers to unsubscribe newsletter subscribers via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.
Product
Newsletter – Send awesome emails from
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update Newsletter – Send awesome emails from to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2026CM E-Mail Blacklist – Simple email filtering for safer registration: Stored Cross-Site ScriptingCVE-2026-0691 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
CM E-Mail Blacklist – Simple email filtering for safer registration
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update CM E-Mail Blacklist – Simple email filtering for safer registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026RepairBuddy – Repair Shop CRM & Booking Plugin for: Insecure Direct Object ReferenceCVE-2026-0820 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions up to, and including, 4.1116. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary signatures to any order in the system, potentially modifying order metadata and triggering unauthorized status changes.
Product
RepairBuddy – Repair Shop CRM & Booking Plugin for
Affected
up to 4.1116
What to do
Affects up to 4.1116. Update RepairBuddy – Repair Shop CRM & Booking Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Quick Contact Form: Open Mail RelayCVE-2025-12718 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form' AJAX endpoint allowing a user controlled parameter to set the 'from' email address. This makes it possible for unauthenticated attackers to send emails to arbitrary recipients utilizing the server. The information is limited to the contact form submission details.
Product
Quick Contact Form
Affected
up to 8.2.6
What to do
Affects up to 8.2.6. Update Quick Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2026Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiCVE-2019-25297 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiple parameters due to insufficient input validation and output escaping. An unauthenticated attacker can inject arbitrary script into content that executes when a victim views an affected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org web.archive.org
Jan 16, 2026the bundled plupload example endpoint: Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file uploadCVE-2012-10064 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without enforcing safe file type restrictions, enabling an attacker to place attacker-controlled files under the plugin's uploads directory. This can lead to remote code execution if a server-executable file type is uploaded and subsequently accessed.
Product
the bundled plupload example endpoint
What to do
Update the bundled plupload example endpoint to the newest version.
Full record and what to do →NVD record packetstorm.news web.archive.org
Jan 16, 2026LEAV Last Email Address Validator: Cross-Site Request ForgeryCVE-2025-14853 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions <= 1.7.1. This is due to missing or incorrect nonce validation on the display_settings_page function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
LEAV Last Email Address Validator
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update LEAV Last Email Address Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026MailerLite - WooCommerce integration: Unauthorized data modification and deletionCVE-2026-1000 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's integration settings, delete all plugin options, and drop the plugin's database tables (woo_mailerlite_carts and woo_mailerlite_jobs), resulting in complete loss of plugin data including customer abandoned cart information and sync job history.
Product
MailerLite - WooCommerce integration
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update MailerLite - WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2026process_upload.php due to missing file type validation: Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file uploadCVE-2011-10041 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.
Product
process_upload.php due to missing file type validation
Affected
up to 1.0
What to do
Affects up to 1.0. Update process_upload.php due to missing file type validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstorm.news wpscan.com
Jan 15, 2026Kalium 3 | Creative WordPress & WooCommerce: Unauthorized email sendingCVE-2025-12895 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf.
Product
Kalium 3 | Creative WordPress & WooCommerce
Affected
up to 3.29
What to do
Affects up to 3.29. Update Kalium 3 | Creative WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record documentation.laborator.co themeforest.net
Jan 14, 2026GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation: Stored Cross-Site ScriptingCVE-2025-15266 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat message field in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the Chat History page.
Product
GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 14, 2026Integration Opvius AI for WooCommerce: Path TraversalCVE-2025-14301 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the `process_table_bulk_actions()` function processing user-supplied file paths without authentication checks, nonce verification, or path validation. This makes it possible for unauthenticated attackers to delete or download arbitrary files on the server via the `wsaw-log[]` POST parameter, which can be leveraged to delete critical files like `wp-config.php` or read sensitive configuration files.
Product
Integration Opvius AI for WooCommerce
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Integration Opvius AI for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 13, 2026Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries.CVE-2023-54333 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted POST requests with malicious SQL payloads to retrieve and potentially steal entire database contents.
Product
Social-Share-Buttons
What to do
Update Social-Share-Buttons to the newest version.
Full record and what to do →NVD record github.com supsystic.com
Jan 13, 2026the contact form module that: Jetpack 11.4 contains a cross-site scriptingCVE-2023-54332 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.
Product
the contact form module that
Affected
11.4 to 11.4
What to do
Affects 11.4 to 11.4. Update the contact form module that to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jan 13, 2026the slider import search feature and tab parameter: WPForms 1.7.8 contains a cross-site scriptingCVE-2020-36919 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.
Product
the slider import search feature and tab parameter
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update the slider import search feature and tab parameter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jan 9, 2026the Login Widget: AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code executionCVE-2020-36875 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.
Product
the Login Widget
What to do
Update the Login Widget to the newest version.
Full record and what to do →NVD record accessally.com wpscan.com
Jan 8, 2026Campaign Monitor for: Missing AuthorizationCVE-2026-0674 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Campaign Monitor for WordPress: from n/a through 2.9.1.
Product
Campaign Monitor for
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Campaign Monitor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026Optional Email: Privilege EscalationCVE-2025-15018 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts.
Product
Optional Email
Affected
up to 1.3.11
What to do
Affects up to 1.3.11. Update Optional Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026Newsletter Email Subscribe: Cross-Site Request ForgeryCVE-2025-14904 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect nonce validation on the nels_settings_page function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Newsletter Email Subscribe
Affected
up to 2.4
What to do
Affects up to 2.4. Update Newsletter Email Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026twinklesmtp – Email Service Provider For: Stored Cross-Site ScriptingCVE-2025-14887 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
twinklesmtp – Email Service Provider For
Affected
up to 1.03
What to do
Affects up to 1.03. Update twinklesmtp – Email Service Provider For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026QR Code for WooCommerce order emails, PDF invoices, packing slips: Stored Cross-Site ScriptingCVE-2025-14626 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.9.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
QR Code for WooCommerce order emails, PDF invoices, packing slips
Affected
up to 1.9.42
What to do
Affects up to 1.9.42. Update QR Code for WooCommerce order emails, PDF invoices, packing slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026EmailKit: Arbitrary File ReadCVE-2025-14059 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template REST API endpoint where user-controlled input from the emailkit-editor-template parameter is passed directly to file_get_contents() without sanitization. This makes it possible for authenticated attackers with Author-level permissions or higher to read arbitrary files on the server, including sensitive configuration files like /etc/passwd and wp-config.php, via the REST API. The file contents are stored in post meta and can be exfiltrated through MetForm's email confirmation feature.
Product
EmailKit
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update EmailKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Email Customizer for WooCommerce: Stored Cross-Site ScriptingCVE-2025-13974 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in email templates that will execute when customers view transactional emails. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Email Customizer for WooCommerce
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026AI BotKit – AI Chatbot & Live Support for: Stored Cross-Site ScriptingCVE-2025-13887 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AI BotKit – AI Chatbot & Live Support for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the `ai_botkit_widget` shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AI BotKit – AI Chatbot & Live Support for
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update AI BotKit – AI Chatbot & Live Support for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2026Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: Unauthorized modification of dataCVE-2025-14371 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in all versions up to, and including, 3.41.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to add or remove taxonomy terms (tags, categories) on any post, including ones they do not own.
Product
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
Affected
up to 3.41.0
What to do
Affects up to 3.41.0. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Jan 6, 2026Xagio SEO – AI Powered SEO: Server-Side Request ForgeryCVE-2025-14438 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixabayDownloadImage' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Xagio SEO – AI Powered SEO
Affected
up to 7.1.0.30
What to do
Affects up to 7.1.0.30. Update Xagio SEO – AI Powered SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 5, 2026The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin forCVE-2025-11370 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings.
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 5, 2026Team: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-14124 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
Team
Fixed in
5.0.11
What to do
Update Team to 5.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Dec 31, 2025WP Gmail SMTP: Cross-Site Request Forgery (CSRF)CVE-2025-62123 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Cross Site Request Forgery.This issue affects WP Gmail SMTP: from n/a through <= 1.0.7.
Product
WP Gmail SMTP
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update WP Gmail SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: Missing AuthorizationCVE-2025-62154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in recorp AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One ai-content-writing-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: from n/a through <= 1.1.7.
Product
AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025AI Copilot: Missing AuthorizationCVE-2025-62116 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in quadlayers AI Copilot ai-copilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Copilot: from n/a through <= 1.5.2.
Product
AI Copilot
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update AI Copilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Locatoraid Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62140 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware Locatoraid Store Locator locatoraid allows Stored XSS.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.68.
Product
Locatoraid Store Locator
Affected
up to 3.9.68
What to do
Affects up to 3.9.68. Update Locatoraid Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Zoho ZeptoMail: Cross-Site Request Forgery (CSRF)CVE-2025-49028 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Zoho Mail Zoho ZeptoMail transmail allows Stored XSS.This issue affects Zoho ZeptoMail: from n/a through <= 3.3.1.
Product
Zoho ZeptoMail
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Zoho ZeptoMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025contact-form-7-mailchimp-extension: Insertion of Sensitive Information Into Sent DataCVE-2025-68989 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-extension: from n/a through <= 0.9.68.
Product
contact-form-7-mailchimp-extension
Affected
up to 0.9.68
What to do
Affects up to 0.9.68. Update contact-form-7-mailchimp-extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Claspo – Popups, Spin the Wheel & Email Capture: Missing AuthorizationCVE-2025-68568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Claspo – Popups, Spin the Wheel & Email Capture: from n/a through <= 1.0.7.
Product
Claspo – Popups, Spin the Wheel & Email Capture
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Claspo – Popups, Spin the Wheel & Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025WP Email Capture: Cross-Site Request Forgery (CSRF)CVE-2025-68529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.
Product
WP Email Capture
Affected
up to 3.12.5
What to do
Affects up to 3.12.5. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Review Disclaimer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67628 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AMP-MODE Review Disclaimer review-disclaimer allows Stored XSS.This issue affects Review Disclaimer: from n/a through <= 2.0.3.
Product
Review Disclaimer
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Review Disclaimer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 22, 2025A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration.CVE-2025-15033 · WordPress plugins & themes · reported by WPScanMedium 6.5
A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.
Fixed in
8.1.3
What to do
Update the plugin to 8.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Dec 20, 2025Tainacan: Unauthorized metadata section creationCVE-2025-14043 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and including, 1.0.1. This is due to the `create_item_permissions_check()` function unconditionally returning true, which bypasses authentication and authorization validation. This makes it possible for unauthenticated attackers to create arbitrary metadata sections for any collection via the public REST API granted they can access the WordPress site.
Product
Tainacan
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025WP AI CoPilot: Insertion of Sensitive Information Into Sent DataCVE-2025-62998 · WordPress plugins & themes · reported by PatchstackMedium 5
Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through <= 1.2.7.
Product
WP AI CoPilot
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WP AI CoPilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Offload, AI & Optimize with Cloudflare Images: Missing AuthorizationCVE-2025-66104 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anton Vanyukov Offload, AI & Optimize with Cloudflare Images cf-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Offload, AI & Optimize with Cloudflare Images: from n/a through <= 1.9.5.
Product
Offload, AI & Optimize with Cloudflare Images
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update Offload, AI & Optimize with Cloudflare Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Email marketing for WordPress by GetResponse Official: Missing AuthorizationCVE-2025-64273 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
Product
Email marketing for WordPress by GetResponse Official
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Email marketing for WordPress by GetResponse Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Email marketing for WordPress by GetResponse Official: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64272 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Retrieve Embedded Sensitive Data.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
Product
Email marketing for WordPress by GetResponse Official
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Email marketing for WordPress by GetResponse Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64203 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster allows Reflected XSS.This issue affects Mailster: from n/a through < 4.1.14.
Product
Mailster
What to do
Update Mailster to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025DetailX: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60058 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DetailX detailx allows PHP Local File Inclusion.This issue affects DetailX: from n/a through <= 1.10.0.
Product
DetailX
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update DetailX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025DJ Rainflow: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60057 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DJ Rainflow dj-rainflow allows PHP Local File Inclusion.This issue affects DJ Rainflow: from n/a through <= 1.3.13.
Product
DJ Rainflow
Affected
up to 1.3.13
What to do
Affects up to 1.3.13. Update DJ Rainflow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Download After Email: Missing AuthorizationCVE-2025-54743 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download After Email: from n/a through 2.1.5-2.1.6.
Product
Download After Email
Affected
up to 2.1.5-2.1.6
What to do
Affects up to 2.1.5-2.1.6. Update Download After Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Faith & Hope: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52768 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Faith & Hope faith-hope allows PHP Local File Inclusion.This issue affects Faith & Hope: from n/a through <= 2.13.0.
Product
Faith & Hope
Affected
up to 2.13.0
What to do
Affects up to 2.13.0. Update Faith & Hope to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Contact Form Email: Authorization Bypass Through User-Controlled KeyCVE-2025-10019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.60.
Product
Contact Form Email
Affected
up to 1.3.60
What to do
Affects up to 1.3.60. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.