Updated 15 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

3,184 results · page 21 of 64

Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1623 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.9
What to do
Update GDPR Cookie Compliance to 4.15.9 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1622 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025Poll Maker: Does not sanitise and escape some of its settingsCVE-2024-13602 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Poll Maker
Fixed in
5.5.4
What to do
Update Poll Maker to 5.5.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 15, 2025Recapture for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-26899 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Recapture Cart Recovery and Email Marketing Recapture for WooCommerce recapture-for-woocommerce allows Cross Site Request Forgery.This issue affects Recapture for WooCommerce: from n/a through <= 1.0.43.
Product
Recapture for WooCommerce
Affected
up to 1.0.43
What to do
Affects up to 1.0.43. Update Recapture for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2025WoWPth: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1487 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WoWPth
Affected
up to 2.0
What to do
Affects up to 2.0. Update WoWPth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025WoWPth: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1486 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WoWPth
Affected
up to 2.0
What to do
Affects up to 2.0. Update WoWPth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025WP Click Info: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1401 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Click Info WordPress plugin through 2.7.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WP Click Info
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update WP Click Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025Schedule: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13891 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Schedule WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Schedule
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025WP e-Customers Beta: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13885 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP e-Customers Beta
Affected
up to 0.0.1
What to do
Affects up to 0.0.1. Update WP e-Customers Beta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025Limit Bio: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13884 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Limit Bio WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Limit Bio
Affected
up to 1.0
What to do
Affects up to 1.0. Update Limit Bio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 11, 2025Coronavirus (COVID-19) Notice Message: Does not sanitise and escape some of its settingsCVE-2025-0629 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Coronavirus (COVID-19) Notice Message
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Coronavirus (COVID-19) Notice Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025Countdown Timer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13864 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Countdown Timer
Affected
up to 1.0
What to do
Affects up to 1.0. Update Countdown Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13862 · WordPress plugins & themes · reported by WPScanHigh 7.1
The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality)
Affected
up to 8.0
What to do
Affects up to 8.0. Update S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025SEO Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13853 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
SEO Tools
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 11, 2025WP Login Control: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13836 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Login Control
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Login Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap: Does not sanitise and escape some of its settingsCVE-2024-13615 · WordPress plugins & themes · reported by WPScanLow 3.5
The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025XV Random Quotes: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13574 · WordPress plugins & themes · reported by WPScanHigh 7.1
The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
XV Random Quotes
Affected
up to 1.40
What to do
Affects up to 1.40. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 9, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Does not sanitise and escape some of its settingsCVE-2025-1363 · WordPress plugins & themes · reported by WPScanLow 3.5
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
URL Shortener | Conversion Tracking | AB Testing | WooCommerce
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 8, 2025Email Keep: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13825 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Email Keep
Affected
up to 1.1
What to do
Affects up to 1.1. Update Email Keep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2025Reservit Hotel: Does not sanitise and escape some of its settingsCVE-2024-9458 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Reservit Hotel
Fixed in
3.0
What to do
Update Reservit Hotel to 3.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 7, 2025WordPress Activity O Meter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13668 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.
Product
WordPress Activity O Meter
Affected
up to 1.0
What to do
Affects up to 1.0. Update WordPress Activity O Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 6, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13868 · WordPress plugins & themes · reported by WPScanMedium 6.1
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
URL Shortener | Conversion Tracking | AB Testing | WooCommerce
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025R3W InstaFeed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13678 · WordPress plugins & themes · reported by WPScanMedium 6.1
The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
R3W InstaFeed
Affected
up to 1.0
What to do
Affects up to 1.0. Update R3W InstaFeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025CalendApp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13669 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
CalendApp
Affected
up to 1.1
What to do
Affects up to 1.1. Update CalendApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Post Sync: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13634 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Post Sync
Affected
up to 1.1
What to do
Affects up to 1.1. Update Post Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Simple catalogue: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13633 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Simple catalogue
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Simple catalogue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WP Extra Fields: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13632 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Extra Fields
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Om Stripe: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13631 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Om Stripe
Affected
up to 02.00.00
What to do
Affects up to 02.00.00. Update Om Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025NewsTicker: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13630 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
NewsTicker
Affected
up to 1.0
What to do
Affects up to 1.0. Update NewsTicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025pushBIZ: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13629 · WordPress plugins & themes · reported by WPScanMedium 6.1
The pushBIZ WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
pushBIZ
Affected
up to 1.0
What to do
Affects up to 1.0. Update pushBIZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WP Pricing Table: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13628 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Pricing Table
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WPMovieLibrary: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13624 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WPMovieLibrary
Affected
up to 2.1.4.8
What to do
Affects up to 2.1.4.8. Update WPMovieLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Post Timeline: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13571 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Post Timeline
Fixed in
2.3.10
What to do
Update Post Timeline to 2.3.10 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Countdown Timer for Elementor: Does not sanitise and escape some parametersCVE-2024-13113 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
Countdown Timer for Elementor
Fixed in
1.3.7
What to do
Update Countdown Timer for Elementor to 1.3.7 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Custom Block Builder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12878 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Custom Block Builder
Fixed in
3.8.3
What to do
Update Custom Block Builder to 3.8.3 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WP BASE Booking of Appointments, Services and Events: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12737 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP BASE Booking of Appointments, Services and Events
Fixed in
5.0.0
What to do
Update WP BASE Booking of Appointments, Services and Events to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WooCommerce Cart Count Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10563 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WooCommerce Cart Count Shortcode
Fixed in
1.1.0
What to do
Update WooCommerce Cart Count Shortcode to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Simple:Press Forum: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-10483 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Product
Simple:Press Forum
Fixed in
6.10.11
What to do
Update Simple:Press Forum to 6.10.11 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Simple Certain Time to Show Content: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-10152 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Simple Certain Time to Show Content
Fixed in
1.3.1
What to do
Update Simple Certain Time to Show Content to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Feb 25, 2025Advanced Google reCaptcha: CAPTCHA BypassCVE-2025-1262 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
Product
Advanced Google reCaptcha
Affected
up to 1.27
What to do
Affects up to 1.27. Update Advanced Google reCaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 25, 2025Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Image settingsCVE-2024-10545 · WordPress plugins & themes · reported by WPScanLow 3.5
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery, Sliders, Proofing and
Fixed in
3.59.9
What to do
Update Photo Gallery, Sliders, Proofing and to 3.59.9 or newer.
Full record and what to do →NVD record wpscan.com
Feb 24, 2025Photo Contest | Competition | Video Contest: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13822 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Photo Contest | Competition | Video Contest
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Photo Contest | Competition | Video Contest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 24, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.33
What to do
Update Form Maker by 10Web to 1.15.33 or newer.
Full record and what to do →NVD record wpscan.com
Feb 24, 2025Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-12308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Logo Slider
Fixed in
4.6.0
What to do
Update Logo Slider to 4.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Feb 21, 2025Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-13585 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ajax Search Lite
Fixed in
4.12.5
What to do
Update Ajax Search Lite to 4.12.5 or newer.
Full record and what to do →NVD record wpscan.com
Feb 21, 2025Carousel, Slider, Gallery by WP Carousel: Does not sanitise and escape some of its settingsCVE-2024-13314 · WordPress plugins & themes · reported by WPScanLow 3.5
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Carousel, Slider, Gallery by WP Carousel
Fixed in
2.7.4
What to do
Update Carousel, Slider, Gallery by WP Carousel to 2.7.4 or newer.
Full record and what to do →NVD record wpscan.com
Feb 19, 2025Master Slider: Does not sanitise and escape some of its settingsCVE-2024-12173 · WordPress plugins & themes · reported by WPScanLow 3.5
The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Master Slider
Fixed in
3.10.5
What to do
Update Master Slider to 3.10.5 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.