Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

495new WordPress flaws this week

395,110entries in the database

24,548 results · page 286 of 491

Feb 18, 2025Paid Videochat Turnkey Site: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-22663 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Path Traversal.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.2.12.
Product
Paid Videochat Turnkey Site
Affected
up to 7.2.12
What to do
Affects up to 7.2.12. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Atarim: Missing AuthorizationCVE-2025-22657 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.0.9.
Product
Atarim
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Cookie Monster: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22656 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Oscar Alvarez Cookie Monster cookie-monster allows PHP Local File Inclusion.This issue affects Cookie Monster: from n/a through <= 1.2.2.
Product
Cookie Monster
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Cookie Monster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Smartarget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget smartarget-contact-us allows Stored XSS.This issue affects Smartarget: from n/a through <= 1.5.3.
Product
Smartarget
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Smartarget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Real Estate Manager: Improper Restriction of Excessive Authentication AttemptsCVE-2025-22645 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Password Brute Forcing.This issue affects Real Estate Manager: from n/a through <= 7.3.
Product
Real Estate Manager
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Distance Rate Shipping for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22639 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn Distance Rate Shipping for WooCommerce distance-rate-shipping-for-woocommerce-pro allows Blind SQL Injection.This issue affects Distance Rate Shipping for WooCommerce: from n/a through <= 1.3.4.
Product
Distance Rate Shipping for WooCommerce
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Distance Rate Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Uncode Core: Arbitrary shortcode executionCVE-2024-13689 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
Uncode Core
Affected
up to 2.9.1.6
What to do
Affects up to 2.9.1.6. Update Uncode Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.undsgn.com wordfence.com
Feb 18, 2025PressMart - Modern Elementor WooCommerce: Arbitrary shortcode executionCVE-2024-13797 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
PressMart - Modern Elementor WooCommerce
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update PressMart - Modern Elementor WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 18, 2025Tour Master - Tour Booking, Travel, Hotel: Time-based SQL InjectionCVE-2024-13369 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tour Master - Tour Booking, Travel, Hotel
Affected
up to 5.3.7
What to do
Affects up to 5.3.7. Update Tour Master - Tour Booking, Travel, Hotel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net support.goodlayers.com
Feb 18, 2025CarSpot – Dealership Wordpress Classified: Privilege escalationCVE-2024-12860 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
CarSpot – Dealership Wordpress Classified
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update CarSpot – Dealership Wordpress Classified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 18, 2025s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Reflected Cross-Site ScriptingCVE-2024-11376 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 241114. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 241114
What to do
Affects up to 241114. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Affiliate Links: WordPress Plugin for Link Cloaking and Link Management: PHP Object InjectionCVE-2024-13556 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.1 via deserialization of untrusted input from an file export. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Affiliate Links: WordPress Plugin for Link Cloaking and Link Management
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Affiliate Links: WordPress Plugin for Link Cloaking and Link Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Option Editor: Cross-Site Request Forgery in version 1CVE-2024-13852 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the plugin_page() function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Option Editor
What to do
Update Option Editor to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 18, 2025Reaction Buttons: Stored Cross-Site ScriptingCVE-2024-13848 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Reaction Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Reaction Buttons
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Reaction Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 18, 2025Keap Official Opt-in Forms: Local File InclusionCVE-2024-13725 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution.
Product
Keap Official Opt-in Forms
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Team Builder – Meet the Team: Unauthorized modification of dataCVE-2024-13687 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_team_builder_options() function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
Team Builder – Meet the Team
Affected
up to 1.3
What to do
Affects up to 1.3. Update Team Builder – Meet the Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025GetBookingsWP – Appointments Booking Calendar Plugin For: Privilege escalationCVE-2024-13677 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.27. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
GetBookingsWP – Appointments Booking Calendar Plugin For
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update GetBookingsWP – Appointments Booking Calendar Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025File Uploads Addon for WooCommerce: Sensitive Information ExposureCVE-2024-13622 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments uploaded by customers.
Product
File Uploads Addon for WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update File Uploads Addon for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Sensitive Information ExposureCVE-2024-13609 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.
Product
1 Click WordPress Migration Plugin – 100% FREE for a limited time
Affected
up to 2.2
What to do
Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Simple Signup Form: SQL InjectionCVE-2024-13595 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including, 1.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Simple Signup Form
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Simple Signup Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Zigaform – Price Calculator & Cost Estimation Form Builder Lite: Stored Cross-Site ScriptingCVE-2024-13587 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_fvar' shortcode in all versions up to, and including, 7.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Zigaform – Price Calculator & Cost Estimation Form Builder Lite
Affected
up to 7.4.7
What to do
Affects up to 7.4.7. Update Zigaform – Price Calculator & Cost Estimation Form Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Cross-Site Request ForgeryCVE-2024-13555 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancel_actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
1 Click WordPress Migration Plugin – 100% FREE for a limited time
Affected
up to 2.2
What to do
Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 18, 2025WooODT Lite – Delivery & pickup date time location for WooCommerce: Full Path DisclosureCVE-2024-13540 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodt_get_all_orders.php file being publicly accessible and generating a publicly visible error message. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
WooODT Lite – Delivery & pickup date time location for WooCommerce
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WooODT Lite – Delivery & pickup date time location for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Actionwear products sync: Full Path DisclosureCVE-2024-13535 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-setup.php file being publicly accessible with 'display_errors' set to true. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Actionwear products sync
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Actionwear products sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 17, 2025Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26778 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery gallery allows Stored XSS.This issue affects Gallery: from n/a through <= 2.2.1.
Product
Gallery
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025BEAR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26775 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 BEAR woo-bulk-editor allows Stored XSS.This issue affects BEAR: from n/a through <= 1.1.4.4.
Product
BEAR
Affected
up to 1.1.4.4
What to do
Affects up to 1.1.4.4. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025Analytify: Missing AuthorizationCVE-2025-26773 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through <= 5.5.0.
Product
Analytify
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025DethemeKit For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26772 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.8.
Product
DethemeKit For Elementor
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025SKT Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26771 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through <= 1.7.
Product
SKT Blocks
Affected
up to 1.7
What to do
Affects up to 1.7. Update SKT Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025Waymark: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26770 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Waymark waymark allows Stored XSS.This issue affects Waymark: from n/a through <= 1.5.0.
Product
Waymark
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Waymark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025Vertex Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26769 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Stored XSS.This issue affects Vertex Addons for Elementor: from n/a through <= 1.2.0.
Product
Vertex Addons for Elementor
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Vertex Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025Spotlight Social Media Feeds: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26758 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RebelCode Spotlight Social Media Feeds spotlight-social-photo-feeds allows Retrieve Embedded Sensitive Data.This issue affects Spotlight Social Media Feeds: from n/a through <= 1.7.1.
Product
Spotlight Social Media Feeds
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Spotlight Social Media Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025Timeline Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26754 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block timeline-block-block allows Stored XSS.This issue affects Timeline Block: from n/a through <= 1.1.1.
Product
Timeline Block
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Timeline Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025ImageMeta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23845 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta imagemeta allows Reflected XSS.This issue affects ImageMeta: from n/a through <= 1.1.2.
Product
ImageMeta
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update ImageMeta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025WP-NOTCAPTCHA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjema WP-NOTCAPTCHA wp-notcaptcha allows Reflected XSS.This issue affects WP-NOTCAPTCHA: from n/a through <= 1.3.1.
Product
WP-NOTCAPTCHA
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WP-NOTCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2025Coder: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-13726 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Coder
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Coder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 16, 2025Keep Backup Daily: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26779 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Path Traversal.This issue affects Keep Backup Daily: from n/a through <= 2.1.0.
Product
Keep Backup Daily
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025Qubely: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26767 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.12.
Product
Qubely
Affected
up to 1.8.12
What to do
Affects up to 1.8.12. Update Qubely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025Leyka: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26766 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows Stored XSS.This issue affects Leyka: from n/a through <= 3.31.8.
Product
Leyka
Affected
up to 3.31.8
What to do
Affects up to 3.31.8. Update Leyka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025Distance Based Shipping Calculator: Missing AuthorizationCVE-2025-26765 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Distance Based Shipping Calculator: from n/a through <= 2.0.22.
Product
Distance Based Shipping Calculator
Affected
up to 2.0.22
What to do
Affects up to 2.0.22. Update Distance Based Shipping Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025Easy Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26761 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.5.
Product
Easy Elementor Addons
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025WP Airbnb Review Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26755 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider wp-airbnb-review-slider allows Blind SQL Injection.This issue affects WP Airbnb Review Slider: from n/a through <= 3.9.
Product
WP Airbnb Review Slider
Affected
up to 3.9
What to do
Affects up to 3.9. Update WP Airbnb Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025Botnet Attack Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23975 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.
Product
Botnet Attack Blocker
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Botnet Attack Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025Forex Calculators: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Levan Tarbor Forex Calculators fx-calculators allows Stored XSS.This issue affects Forex Calculators: from n/a through <= 1.3.6.
Product
Forex Calculators
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Forex Calculators to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025Ad Inserter Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22680 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue affects Ad Inserter Pro: from n/a through 2.7.39.
Product
Ad Inserter Pro
Affected
up to 2.7.39
What to do
Affects up to 2.7.39. Update Ad Inserter Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025AWS S3 for WordPress Plugin – Upcasted: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22676 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in upcasted AWS S3 for WordPress Plugin – Upcasted upcasted-s3-offload allows Stored XSS.This issue affects AWS S3 for WordPress Plugin – Upcasted: from n/a through <= 3.0.3.
Product
AWS S3 for WordPress Plugin – Upcasted
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update AWS S3 for WordPress Plugin – Upcasted to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025LTL Freight Quotes – Worldwide Express Edition: Missing AuthorizationCVE-2025-22291 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.20.
Product
LTL Freight Quotes – Worldwide Express Edition
Affected
up to 5.0.20
What to do
Affects up to 5.0.20. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025LTL Freight Quotes – FreightQuote Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22290 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows SQL Injection.This issue affects LTL Freight Quotes – FreightQuote Edition: from n/a through <= 2.3.11.
Product
LTL Freight Quotes – FreightQuote Edition
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update LTL Freight Quotes – FreightQuote Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025LTL Freight Quotes – Unishippers Edition: Missing AuthorizationCVE-2025-22289 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through <= 2.5.8.
Product
LTL Freight Quotes – Unishippers Edition
Affected
up to 2.5.8
What to do
Affects up to 2.5.8. Update LTL Freight Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 16, 2025LTL Freight Quotes – Worldwide Express Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22286 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Reflected XSS.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.21.
Product
LTL Freight Quotes – Worldwide Express Edition
Affected
up to 5.0.21
What to do
Affects up to 5.0.21. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.