Updated 43 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

504new WordPress flaws this week

395,358entries in the database

24,557 results · page 290 of 492

Feb 7, 2025NextGen Cooliris Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25091 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackdesign NextGen Cooliris Gallery nextgen-cooliris-gallery allows Stored XSS.This issue affects NextGen Cooliris Gallery: from n/a through <= 0.7.
Product
NextGen Cooliris Gallery
Affected
up to 0.7
What to do
Affects up to 0.7. Update NextGen Cooliris Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025WP SimpleWeather: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25085 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather wp-simpleweather allows Stored XSS.This issue affects WP SimpleWeather: from n/a through <= 0.2.5.
Product
WP SimpleWeather
Affected
up to 0.2.5
What to do
Affects up to 0.2.5. Update WP SimpleWeather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025FlexIDX Home Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25082 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allows Stored XSS.This issue affects FlexIDX Home Search: from n/a through <= 2.1.2.
Product
FlexIDX Home Search
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update FlexIDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Embed RSS: Missing AuthorizationCVE-2025-25081 · WordPress plugins & themes · reported by PatchstackMedium 4.2
Missing Authorization vulnerability in DeannaS Embed RSS embed-rss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Embed RSS: from n/a through <= 3.1.
Product
Embed RSS
Affected
up to 3.1
What to do
Affects up to 3.1. Update Embed RSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Kona Gallery Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gutenberg allows Stored XSS.This issue affects Kona Gallery Block: from n/a through <= 1.7.
Product
Kona Gallery Block
Affected
up to 1.7
What to do
Affects up to 1.7. Update Kona Gallery Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Simple Select All Text Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box simple-select-all-text-box allows Stored XSS.This issue affects Simple Select All Text Box: from n/a through <= 3.2.
Product
Simple Select All Text Box
Affected
up to 3.2
What to do
Affects up to 3.2. Update Simple Select All Text Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Google Earth Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25078 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrew Norcross Google Earth Embed google-earth-tours allows Stored XSS.This issue affects Google Earth Embed: from n/a through <= 1.0.
Product
Google Earth Embed
Affected
up to 1.0
What to do
Affects up to 1.0. Update Google Earth Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Easy Chart Builder for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25077 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugbug Easy Chart Builder for WordPress easy-chart-builder allows Stored XSS.This issue affects Easy Chart Builder for WordPress: from n/a through <= 1.3.
Product
Easy Chart Builder for
Affected
up to 1.3
What to do
Affects up to 1.3. Update Easy Chart Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Graceful Email Obfuscation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25076 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicholaswilson Graceful Email Obfuscation graceful-email-obfuscation allows Stored XSS.This issue affects Graceful Email Obfuscation: from n/a through <= 0.2.2.
Product
Graceful Email Obfuscation
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update Graceful Email Obfuscation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Easy WP Tiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25073 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vasilis Triantafyllou Easy WP Tiles easy-wp-tiles allows Stored XSS.This issue affects Easy WP Tiles: from n/a through <= 1.
Product
Easy WP Tiles
Affected
up to 1
What to do
Affects up to 1. Update Easy WP Tiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time: Information ExposureCVE-2024-13841 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via the 'bse-elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created with Elementor that they should not have access to.
Product
Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2025Guten Free Options: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13492 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Guten Free Options
Affected
up to 0.9.5
What to do
Affects up to 0.9.5. Update Guten Free Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 6, 2025Nextend Social Login Pro: Authentication bypassCVE-2025-1061 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
Nextend Social Login Pro
Affected
up to 3.1.16
What to do
Affects up to 3.1.16. Update Nextend Social Login Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record nextendweb.com nextendweb.com
Feb 6, 2025The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x: Arbitrary shortcode executionCVE-2024-13487 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution via the get_products_price() function in all versions up to, and including, 2.2.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Sensitive Information ExposureCVE-2024-13829 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.0.8 via the 'attachments.php' file. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via forms.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.8
What to do
Affects up to 8.0.8. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2025woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orCVE-2025-24373 · WordPress plugins & themes · reported by GitHubMedium 6.3
woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orders. This vulnerability allows unauthorized users to access any PDF document from a store if they: 1. Have access to a guest document link and 2. Replace the URL variable `my-account` with `bulk`. The issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerability compromises the confidentiality of sensitive documents, affecting all stores using the plugin with the guest access option enabled. This issue has been addressed in version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Fixed in
4.0.0
What to do
Update the plugin to 4.0.0 or newer.
Full record and what to do →NVD record github.com github.com
Feb 4, 2025Post/Page Copying Tool: Improper Control of Generation of Code ('Code Injection')CVE-2025-24677 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Remote Code Inclusion.This issue affects Post/Page Copying Tool: from n/a through <= 2.0.3.
Product
Post/Page Copying Tool
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Post/Page Copying Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025WP24 Domain Check: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24602 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP24 WP24 Domain Check wp24-domain-check allows Reflected XSS.This issue affects WP24 Domain Check: from n/a through <= 1.10.14.
Product
WP24 Domain Check
Affected
up to 1.10.14
What to do
Affects up to 1.10.14. Update WP24 Domain Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Newsletters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24599 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.6.
Product
Newsletters
Affected
up to 4.9.9.6
What to do
Affects up to 4.9.9.6. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24598 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
Product
WP Mailster
Affected
up to 1.8.17.0
What to do
Affects up to 1.8.17.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Find Content IDs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Optimize Worldwide Find Content IDs find-content-ids allows Reflected XSS.This issue affects Find Content IDs: from n/a through <= 1.0.
Product
Find Content IDs
Affected
up to 1.0
What to do
Affects up to 1.0. Update Find Content IDs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025World Cup Predictor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22794 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows Reflected XSS.This issue affects World Cup Predictor: from n/a through <= 1.9.8.
Product
World Cup Predictor
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update World Cup Predictor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Ksher: Missing AuthorizationCVE-2025-22730 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ksher: from n/a through <= 1.1.2.
Product
Ksher
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Ksher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Traveler Code: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22700 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.3.
Product
Traveler Code
What to do
Update Traveler Code to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Traveler Code: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22699 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects Traveler Code: from n/a through < 3.1.2.
Product
Traveler Code
What to do
Update Traveler Code to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Reflected XSS.This issue affects Responsive Blocks: from n/a through <= 1.9.9.
Product
Responsive Blocks
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Document Block – Upload & Embed Docs: Missing AuthorizationCVE-2025-22696 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through <= 1.1.0.
Product
Document Block – Upload & Embed Docs
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Document Block – Upload & Embed Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Alert Box Block – Display notice/alerts in the front end: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22675 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end alert-box-block allows Stored XSS.This issue affects Alert Box Block – Display notice/alerts in the front end: from n/a through <= 1.1.0.
Product
Alert Box Block – Display notice/alerts in the front end
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Alert Box Block – Display notice/alerts in the front end to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Product Blocks for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Product Blocks for WooCommerce product-blocks-for-woocommerce allows Stored XSS.This issue affects Product Blocks for WooCommerce: from n/a through <= 1.9.1.
Product
Product Blocks for WooCommerce
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Product Blocks for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22664 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.3.5.
Product
Survey Maker
Affected
up to 5.1.3.5
What to do
Affects up to 5.1.3.5. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025SendPulse Email Marketing Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22662 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.1.5.
Product
SendPulse Email Marketing Newsletter
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update SendPulse Email Marketing Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Music Press Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22653 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv Music Press Pro music-press-pro allows Stored XSS.This issue affects Music Press Pro: from n/a through <= 1.4.6.
Product
Music Press Pro
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Music Press Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025OnePress: Missing AuthorizationCVE-2025-22643 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in famethemes OnePress onepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnePress: from n/a through <= 2.3.11.
Product
OnePress
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update OnePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Dynamic Conditions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22642 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites Dynamic Conditions dynamicconditions allows Stored XSS.This issue affects Dynamic Conditions: from n/a through <= 1.7.4.
Product
Dynamic Conditions
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Dynamic Conditions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025FM Notification Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22641 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prem Tiwari FM Notification Bar fm-notification-bar allows Stored XSS.This issue affects FM Notification Bar: from n/a through <= 1.0.4.
Product
FM Notification Bar
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update FM Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025B Slider- Gutenberg Slider Block for WP: Information ExposureCVE-2024-13514 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb-slider' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private posts that they should not have access to.
Product
B Slider- Gutenberg Slider Block for WP
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update B Slider- Gutenberg Slider Block for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 4, 2025Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5.CVE-2025-24982 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Feb 3, 2025BoomBox Theme Extensions: Local File InclusionCVE-2024-12859 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the 'boombox_listing' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
BoomBox Theme Extensions
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update BoomBox Theme Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record documentation.px-lab.com wordfence.com
Feb 3, 2025WPJobBoard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24781 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WPJobBoard allows Reflected XSS. This issue affects WPJobBoard: from n/a through 5.10.1.
Product
WPJobBoard
Affected
up to 5.10.1
What to do
Affects up to 5.10.1. Update WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24707 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.24.
Product
Photo Gallery
Affected
up to 2.7.7.24
What to do
Affects up to 2.7.7.24. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Image Gallery – Responsive Photo Gallery: Missing AuthorizationCVE-2025-24697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Realwebcare Image Gallery – Responsive Photo Gallery awesome-responsive-photo-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Gallery – Responsive Photo Gallery: from n/a through <= 1.0.5.
Product
Image Gallery – Responsive Photo Gallery
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Image Gallery – Responsive Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Media Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24684 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through <= 0.4.7.5.
Product
Media Downloader
Affected
up to 0.4.7.5
What to do
Affects up to 0.4.7.5. Update Media Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Custom WP Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24676 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator custom-store-locator allows Reflected XSS.This issue affects Custom WP Store Locator: from n/a through <= 1.4.7.
Product
Custom WP Store Locator
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Custom WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Taxi Booking Manager for WooCommerce: Deserialization of Untrusted DataCVE-2025-24661 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.
Product
Taxi Booking Manager for WooCommerce
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Simple Membership Custom Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24660 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages simple-membership-custom-messages allows Reflected XSS.This issue affects Simple Membership Custom Messages: from n/a through <= 2.4.
Product
Simple Membership Custom Messages
Affected
up to 2.4
What to do
Affects up to 2.4. Update Simple Membership Custom Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Realtyna Provisioning: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning realtyna-provisioning allows Reflected XSS.This issue affects Realtyna Provisioning: from n/a through <= 1.2.2.
Product
Realtyna Provisioning
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Realtyna Provisioning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025XML for Avito: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24646 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS.This issue affects XML for Avito: from n/a through <= 2.5.2.
Product
XML for Avito
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update XML for Avito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025WPGuppy: Missing AuthorizationCVE-2025-24643 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPGuppy: from n/a through <= 1.1.0.
Product
WPGuppy
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Setup Default Featured Image: Missing AuthorizationCVE-2025-24642 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in theme funda Setup Default Featured Image setup-default-feature-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Setup Default Featured Image: from n/a through <= 1.2.
Product
Setup Default Featured Image
Affected
up to 1.2
What to do
Affects up to 1.2. Update Setup Default Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Korea for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2025-24639 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Korea for WooCommerce: from n/a through <= 1.1.11.
Product
Korea for WooCommerce
Affected
up to 1.1.11
What to do
Affects up to 1.1.11. Update Korea for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.