Updated 52 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

519new WordPress flaws this week

395,110entries in the database

41,251 results · page 267 of 826

Nov 11, 2025age-restriction: Does not have authorisation in the age_restrictionRemoteSupportRequest functionCVE-2025-11855 · WordPress plugins & themes · reported by WPScanHigh 7.5
The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password.
Product
age-restriction
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update age-restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 11, 2025WP Go Maps (formerly WP Google Maps): Does not sanitize user input provided via an AJAX actionCVE-2025-11307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.
Product
WP Go Maps (formerly WP Google Maps)
Fixed in
9.0.48
What to do
Update WP Go Maps (formerly WP Google Maps) to 9.0.48 or newer.
Full record and what to do →NVD record wpscan.com
Nov 11, 2025Make Email Customizer for WooCommerce: Lacks proper authorization checks and option validation in its AJAX actionsCVE-2025-11237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.
Product
Make Email Customizer for WooCommerce
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Make Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 10, 2025Progress Bar Blocks for Gutenberg: Stored Cross-Site ScriptingCVE-2025-12880 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Progress Bar Blocks for Gutenberg
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Progress Bar Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025Holiday class post calendar: Remote Code ExecutionCVE-2025-12813 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.
Product
Holiday class post calendar
Affected
up to 7.1
What to do
Affects up to 7.1. Update Holiday class post calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Geopost: Stored Cross-Site ScriptingCVE-2025-12754 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Geopost
Affected
up to 1.2
What to do
Affects up to 1.2. Update Geopost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Chart Expert: Stored Cross-Site ScriptingCVE-2025-12753 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Chart Expert
Affected
up to 1.0
What to do
Affects up to 1.0. Update Chart Expert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Share to Google Classroom: Stored Cross-Site ScriptingCVE-2025-12711 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Share to Google Classroom
Affected
up to 1.0
What to do
Affects up to 1.0. Update Share to Google Classroom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Flickr Show: Stored Cross-Site ScriptingCVE-2025-12672 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flickr Show
Affected
up to 1.5
What to do
Affects up to 1.5. Update Flickr Show to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025WP-Iconics: Stored Cross-Site ScriptingCVE-2025-12671 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, and including, 0.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Iconics
Affected
up to 0.0.4
What to do
Affects up to 0.0.4. Update WP-Iconics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025WP Count Down Timer: Stored Cross-Site ScriptingCVE-2025-12668 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Count Down Timer
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Count Down Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025GitHub Gist Shortcode: Stored Cross-Site ScriptingCVE-2025-12667 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GitHub Gist Shortcode
Affected
up to 0.2
What to do
Affects up to 0.2. Update GitHub Gist Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Ninja Countdown | Fastest Countdown Builder: Unauthorized loss of dataCVE-2025-12665 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary countdowns.
Product
Ninja Countdown | Fastest Countdown Builder
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Ninja Countdown | Fastest Countdown Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025Jeba Cute forkit: Stored Cross-Site ScriptingCVE-2025-12663 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jeba Cute forkit
Affected
up to 1.0
What to do
Affects up to 1.0. Update Jeba Cute forkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Coon Google Maps: Stored Cross-Site ScriptingCVE-2025-12662 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Coon Google Maps
Affected
up to 1.0
What to do
Affects up to 1.0. Update Coon Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Preload Current Images: Stored Cross-Site ScriptingCVE-2025-12658 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Preload Current Images
Affected
up to 1.3
What to do
Affects up to 1.3. Update Preload Current Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Ungapped Widgets: Stored Cross-Site ScriptingCVE-2025-12652 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all versions up to, and including, 1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user accesses an injected page.
Product
Ungapped Widgets
Affected
up to 1
What to do
Affects up to 1. Update Ungapped Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Live Photos on: Stored Cross-Site ScriptingCVE-2025-12651 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user accesses an injected page.
Product
Live Photos on
Affected
up to 0.1
What to do
Affects up to 0.1. Update Live Photos on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Nonaki – Drag and Drop Email Template builder and Newsletter: Stored Cross-Site ScriptingCVE-2025-12644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode in all versions up to, and including, 1.0.11. This is due to insufficient input sanitization and output escaping on user supplied custom field values that are retrieved and rendered by the shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Nonaki – Drag and Drop Email Template builder and Newsletter
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Nonaki – Drag and Drop Email Template builder and Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Elastic Theme Editor: Arbitrary file uploadsCVE-2025-12637 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Elastic Theme Editor
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update Elastic Theme Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025RandomQuotr: Stored Cross-Site ScriptingCVE-2025-12632 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
RandomQuotr
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update RandomQuotr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record it.wordpress.org wordfence.com
Nov 10, 2025Squirrels Auto Inventory: Stored Cross-Site ScriptingCVE-2025-12631 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Squirrels Auto Inventory
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Squirrels Auto Inventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025YSlider: Cross-Site Request Forgery to Stored Cross-Site ScriptingCVE-2025-12590 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses an injected page.
Product
YSlider
Affected
up to 1.1
What to do
Affects up to 1.1. Update YSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025WP-Walla: Cross-Site Request Forgery to Stored Cross-Site ScriptingCVE-2025-12589 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
WP-Walla
Affected
up to 0.5.3.5
What to do
Affects up to 0.5.3.5. Update WP-Walla to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org developer.wordpress.org
Nov 10, 2025USB Qr Code Scanner For Woocommerce: Cross-Site Request ForgeryCVE-2025-12588 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
USB Qr Code Scanner For Woocommerce
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update USB Qr Code Scanner For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Fleet Manager: Stored Cross-Site ScriptingCVE-2025-12538 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Fleet Manager
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Fleet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record it.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Private Google Calendars: Unauthorized modification of dataCVE-2025-12526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgc_remove' action in all versions up to, and including, 20250811. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
Product
Private Google Calendars
Affected
up to 20250811
What to do
Affects up to 20250811. Update Private Google Calendars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025WP Custom Admin Login Page Logo: Cross-Site Request ForgeryCVE-2025-12132 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due to missing or incorrect nonce validation on the wpclpl_save functionality. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Custom Admin Login Page Logo
Affected
up to 1.4.8.4
What to do
Affects up to 1.4.8.4. Update WP Custom Admin Login Page Logo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025The Total Book Project: Insecure Direct Object ReferenceCVE-2025-12126 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform several actions like moving/deleting/creating chapters in books that do not belong to them.
Product
The Total Book Project
Affected
up to 1.0
What to do
Affects up to 1.0. Update The Total Book Project to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025WP-OAuth: Reflected Cross-Site ScriptingCVE-2025-12021 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP-OAuth
Affected
up to 0.4.1
What to do
Affects up to 0.4.1. Update WP-OAuth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Double the Donation – A workplace giving tool to help your fundraising efforts: Stored Cross-Site ScriptingCVE-2025-12020 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Double the Donation – A workplace giving tool to help your fundraising efforts
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Double the Donation – A workplace giving tool to help your fundraising efforts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Featured Image: Stored Cross-Site ScriptingCVE-2025-12019 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Featured Image
Affected
up to 2.1
What to do
Affects up to 2.1. Update Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 10, 2025Authors List: Sensitive Information ExposureCVE-2025-12010 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary method call from Authors_List_Shortcode class. This makes it possible for authenticated attackers, with Contributor-level access and above, to call methods such as get_meta to extract sensitive user data including password hashes, email addresses, usernames, and activation keys via specially crafted shortcode attributes
Product
Authors List
Affected
up to 2.0.6.1
What to do
Affects up to 2.0.6.1. Update Authors List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Add Multiple Marker: Unauthorized modification of data toCVE-2025-11999 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_reset_map() and amm_save_map_api() functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to update the map API and reset maps.
Product
Add Multiple Marker
Affected
up to 1.2
What to do
Affects up to 1.2. Update Add Multiple Marker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Document Pro Elementor – Documentation & Knowledge Base: Information ExposureCVE-2025-11997 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wp_localize_script without proper access restrictions. This makes it possible for unauthenticated attackers to view sensitive API keys in the page source, which could be leveraged to make unauthorized API calls to the configured Algolia search service.
Product
Document Pro Elementor – Documentation & Knowledge Base
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Document Pro Elementor – Documentation & Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Find Unused Images: Unauthorized loss of dataCVE-2025-11996 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_delete_all_images() functiosn in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to delete all of a site's attachments.
Product
Find Unused Images
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Find Unused Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Crypto: Unauthorized manipulation of dataCVE-2025-11988 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the crypto_delete_json method with only a publicly-available nonce check. This makes it possible for unauthenticated attackers to delete specific JSON files matching the pattern *_pending.json within the wp-content/uploads/yak/ directory, causing data loss and denial of service for plugin workflows that rely on these artifacts.
Product
Crypto
Affected
up to 2.22
What to do
Affects up to 2.22. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Crypto: Information exposureCVE-2025-11986 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the register and savenft methods with only a publicly-available nonce check and no wallet signature verification. This makes it possible for unauthenticated attackers to set a site-wide global authentication state via a single transient, bypassing all access controls for ALL visitors to the site. The impact is complete bypass of [crypto-block] shortcode restrictions and page-level access controls, affecting all site visitors for one hour, plus the ability to inject arbitrary data into the plugin's custom_users table.
Product
Crypto
Affected
up to 2.22
What to do
Affects up to 2.22. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Shelf Planner: Unauthorized modification of dataCVE-2025-11894 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings like the ServerKey and LicenseKey.
Product
Shelf Planner
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Shelf Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025Shelf Planner: Sensitive Information ExposureCVE-2025-11891 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shelf Planner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.
Product
Shelf Planner
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Shelf Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025CTL Arcade Lite: Cross-Site Request ForgeryCVE-2025-11886 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'ctl_arcade_lite_page_manage_games' page. This makes it possible for unauthenticated attackers to deactivate and activate arbitrary plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CTL Arcade Lite
Affected
up to 1.0
What to do
Affects up to 1.0. Update CTL Arcade Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025Simple Donate: Stored Cross-Site ScriptingCVE-2025-11882 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's simpledonate shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Donate
What to do
Update Simple Donate to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Slippy Slider – Responsive Touch Navigation Slider: Stored Cross-Site ScriptingCVE-2025-11874 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Slippy Slider – Responsive Touch Navigation Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slippy-slider' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slippy Slider – Responsive Touch Navigation Slider
Affected
up to 2.0
What to do
Affects up to 2.0. Update Slippy Slider – Responsive Touch Navigation Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025WP BBCode: Stored Cross-Site ScriptingCVE-2025-11873 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP BBCode
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update WP BBCode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Precise Columns: Stored Cross-Site ScriptingCVE-2025-11869 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Precise Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wrap_id` shortcode attribute in all versions up to, and including, 1.0. This is due to the plugin not properly sanitizing user input or escaping output when inserting the wrapper ID into the generated HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Precise Columns
Affected
up to 1.0
What to do
Affects up to 1.0. Update Precise Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025My Geo Posts Free: Stored Cross-Site ScriptingCVE-2025-11863 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My Geo Posts Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mygeo_city' shortcode in all versions up to, and including, 1.2. This is due to the plugin not properly sanitizing user input or escaping output of the 'default' shortcode attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My Geo Posts Free
Affected
up to 1.2
What to do
Affects up to 1.2. Update My Geo Posts Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Twitter Feed: Stored Cross-Site ScriptingCVE-2025-11860 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3.1. This is due to the plugin not properly sanitizing user input and output of the 'width' and 'height' parameters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Twitter Feed
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Twitter Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Paypal Donation Shortcode: Stored Cross-Site ScriptingCVE-2025-11859 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions up to, and including, 0.1. This is due to the plugin not properly sanitizing user input and output of the 'title' and 'text' parameters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paypal Donation Shortcode
Affected
up to 0.1
What to do
Affects up to 0.1. Update Paypal Donation Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Eventbee Ticketing Widget: Stored Cross-Site ScriptingCVE-2025-11856 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Eventbee Ticketing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventbeeticketwidget' shortcode in all versions up to, and including, 1.0. This is due to the plugin not properly sanitizing user input and output of several parameters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Eventbee Ticketing Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update Eventbee Ticketing Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Five9 Live Chat: Stored Cross-Site ScriptingCVE-2025-11829 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the [five9-chat] shortcode in all versions up to, and including, 1.1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Five9 Live Chat
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Five9 Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.