Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,557 results · page 294 of 492
Jan 27, 2025Donate visa: Missing AuthorizationCVE-2025-23656 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Saul Morales Pacheco Donate visa donate-visa allows Stored XSS.This issue affects Donate visa: from n/a through <= 1.0.0.
- Product
- Donate visa
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Donate visa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025CubePM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23574 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Lau CubePM cubepm allows Reflected XSS.This issue affects CubePM: from n/a through <= 1.0.
- Product
- CubePM
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CubePM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025RSVPMaker Volunteer Roles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23531 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidfcarr RSVPMaker Volunteer Roles rsvpmaker-volunteer-roles allows Reflected XSS.This issue affects RSVPMaker Volunteer Roles: from n/a through <= 1.5.1.
- Product
- RSVPMaker Volunteer Roles
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update RSVPMaker Volunteer Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Minterpress: Missing AuthorizationCVE-2025-23529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Minterpress: from n/a through <= 1.0.5.
- Product
- Minterpress
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Minterpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Houzez: Missing AuthorizationCVE-2025-24754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.
- Product
- Houzez
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025LTL Freight Quotes – Worldwide Express Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24664 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows SQL Injection.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.20.
- Product
- LTL Freight Quotes – Worldwide Express Edition
- Affected
- up to 5.0.20
- What to do
- Affects up to 5.0.20. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Shipping for Nova Poshta: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24612 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through <= 1.19.6.
- Product
- Shipping for Nova Poshta
- Affected
- up to 1.19.6
- What to do
- Affects up to 1.19.6. Update Shipping for Nova Poshta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025FundPress: Deserialization of Untrusted DataCVE-2025-24601 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0.6.
- Product
- FundPress
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update FundPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Ultimate Store Kit Elementor Addons: Missing AuthorizationCVE-2025-24584 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.3.0.
- Product
- Ultimate Store Kit Elementor Addons
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Passwordless WP – Login with your glance or fingerprint: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23792 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Busters Passwordless WP – Login with your glance or fingerprint passwordless-wp allows Reflected XSS.This issue affects Passwordless WP – Login with your glance or fingerprint: from n/a through <= 1.1.6.
- Product
- Passwordless WP – Login with your glance or fingerprint
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Passwordless WP – Login with your glance or fingerprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Shipdeo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23457 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shipdeoplugin Shipdeo shipdeo-woo allows Reflected XSS.This issue affects Shipdeo: from n/a through <= 1.2.8.
- Product
- Shipdeo
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Shipdeo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Simple Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22513 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Simple Locator simple-locator allows Reflected XSS.This issue affects Simple Locator: from n/a through <= 2.0.4.
- Product
- Simple Locator
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Simple Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 26, 2025Zox News: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11936 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' function in all versions up to, and including, 3.16.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Zox News
- Affected
- up to 3.16.0
- What to do
- Affects up to 3.16.0. Update Zox News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jan 26, 2025Membership Plugin – Restrict Content: Sensitive Information ExposureCVE-2024-11090 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
- Product
- Membership Plugin – Restrict Content
- Affected
- up to 3.2.13
- What to do
- Affects up to 3.2.13. Update Membership Plugin – Restrict Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: Arbitrary shortcode executionCVE-2024-10633 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- Quiz Maker Business, Developer, and Agency
- Affected
- up to 8.8.0
- What to do
- Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordays-pro.comays-pro.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: SQL InjectionCVE-2024-10628 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: The three variations of this software (Business, Developer, and Agency) share the same plugin slug, so you may get an alert even if you are running the latest version of any of the pieces of software. In these cases it is safe to dismiss the notice once you've confirmed your site is on a patched version of the applicable software.
- Product
- Quiz Maker Business, Developer, and Agency
- Affected
- up to 8.8.0
- What to do
- Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordabrahack.comays-pro.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: Unauthorized modification of dataCVE-2024-10574 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ays_save_google_credentials' function in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This makes it possible for unauthenticated attackers to modify the Google Sheets integration credentials within the plugin's settings. Because the 'client_id' parameter is not sanitized or escaped when used in output, this vulnerability could also be leveraged to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Quiz Maker Business, Developer, and Agency
- Affected
- up to 8.8.0
- What to do
- Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordays-pro.comays-pro.com
Jan 25, 2025Import WP – Export and Import CSV and XML files to: Sensitive Information ExposureCVE-2024-13562 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.5 via the uploads directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/ directory which can contain information like imported or local user data and files.
- Product
- Import WP – Export and Import CSV and XML files to
- Affected
- up to 2.14.5
- What to do
- Affects up to 2.14.5. Update Import WP – Export and Import CSV and XML files to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 25, 2025Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Server-Side Request ForgeryCVE-2024-13450 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The vulnerability can also be exploited in Multisite environments.
- Product
- Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
- Affected
- up to 2.17.4
- What to do
- Affects up to 2.17.4. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 25, 2025Boom Fest: Unauthorized modification of dataCVE-2024-13449 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bf_admin_action' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings that change the appearance of the website.
- Product
- Boom Fest
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Boom Fest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 25, 2025ABC Notation: Stored Cross-Site ScriptingCVE-2024-13551 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ABC Notation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abcjs' shortcode in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ABC Notation
- Affected
- up to 6.1.3
- What to do
- Affects up to 6.1.3. Update ABC Notation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordfence.com
Jan 25, 2025ABC Notation: Path TraversalCVE-2024-13550 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ABC Notation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.3 via the 'file' attribute of the 'abcjs' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- ABC Notation
- Affected
- up to 6.1.3
- What to do
- Affects up to 6.1.3. Update ABC Notation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordfence.com
Jan 25, 2025WordPress SEO Friendly Accordion FAQ with AI assisted content generation: Stored Cross-Site ScriptingCVE-2024-13458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress SEO Friendly Accordion FAQ with AI assisted content generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'noticefaq' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WordPress SEO Friendly Accordion FAQ with AI assisted content generation
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WordPress SEO Friendly Accordion FAQ with AI assisted content generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 25, 2025Connections Business Directory: Arbitrary directory deletionCVE-2024-12885 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.
- Product
- Connections Business Directory
- Affected
- up to 10.4.66
- What to do
- Affects up to 10.4.66. Update Connections Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 25, 2025GoHero Store Customizer for WooCommerce: Unauthorized modification of dataCVE-2024-12826 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooh_action_settings_save_frontend() function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to update limited plugin settings.
- Product
- GoHero Store Customizer for WooCommerce
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update GoHero Store Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 25, 2025Custom Product Tabs Lite for WooCommerce: PHP Object InjectionCVE-2024-12600 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deserialization of untrusted input from the 'frs_woo_product_tabs' parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Custom Product Tabs Lite for WooCommerce
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Custom Product Tabs Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 25, 2025ThemeREX Addons: Local File InclusionCVE-2025-0682 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
- Product
- ThemeREX Addons
- Affected
- up to 2.33.0
- What to do
- Affects up to 2.33.0. Update ThemeREX Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jan 25, 2025Plethora Plugins Tabs + Accordions: Stored Cross-Site ScriptingCVE-2024-13721 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Plethora Plugins Tabs + Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the anchor parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Plethora Plugins Tabs + Accordions
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Plethora Plugins Tabs + Accordions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 24, 2025PDF Invoice Builder for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24755 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Stored XSS.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 4.6.0.
- Product
- PDF Invoice Builder for WooCommerce
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Gutenberg Blocks by Kadence Blocks: Missing AuthorizationCVE-2025-24753 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through <= 3.3.1.
- Product
- Gutenberg Blocks by Kadence Blocks
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025CoBlocks: Missing AuthorizationCVE-2025-24751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GoDaddy CoBlocks coblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoBlocks: from n/a through <= 3.1.13.
- Product
- CoBlocks
- Affected
- up to 3.1.13
- What to do
- Affects up to 3.1.13. Update CoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025ExactMetrics: Missing AuthorizationCVE-2025-24750 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Syed Balkhi ExactMetrics google-analytics-dashboard-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ExactMetrics: from n/a through <= 8.1.0.
- Product
- ExactMetrics
- Affected
- up to 8.1.0
- What to do
- Affects up to 8.1.0. Update ExactMetrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Popup Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24746 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Iser Popup Maker popup-maker allows Stored XSS.This issue affects Popup Maker: from n/a through <= 1.20.2.
- Product
- Popup Maker
- Affected
- up to 1.20.2
- What to do
- Affects up to 1.20.2. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Post Duplicator: Missing AuthorizationCVE-2025-24736 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through <= 2.35.
- Product
- Post Duplicator
- Affected
- up to 2.35
- What to do
- Affects up to 2.35. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Post Grid Master: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24733 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows PHP Local File Inclusion.This issue affects Post Grid Master: from n/a through <= 3.4.12.
- Product
- Post Grid Master
- Affected
- up to 3.4.12
- What to do
- Affects up to 3.4.12. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025BookingPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24732 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows DOM-Based XSS.This issue affects BookingPress: from n/a through <= 1.1.25.
- Product
- BookingPress
- Affected
- up to 1.1.25
- What to do
- Affects up to 1.1.25. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Download IP2Location Country Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24731 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IP2Location Download IP2Location Country Blocker ip2location-country-blocker allows Stored XSS.This issue affects Download IP2Location Country Blocker: from n/a through <= 2.38.3.
- Product
- Download IP2Location Country Blocker
- Affected
- up to 2.38.3
- What to do
- Affects up to 2.38.3. Update Download IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP VR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24730 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.14.
- Product
- WP VR
- Affected
- up to 8.5.14
- What to do
- Affects up to 8.5.14. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24729 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.3.
- Product
- ElementInvader Addons for Elementor
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Bug Library: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24728 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yannick Lefebvre Bug Library bug-library allows Blind SQL Injection.This issue affects Bug Library: from n/a through <= 2.1.4.
- Product
- Bug Library
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Bug Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Contact Form Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24727 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through <= 1.3.52.
- Product
- Contact Form Email
- Affected
- up to 1.3.52
- What to do
- Affects up to 1.3.52. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025HT Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24726 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 1.2.1.
- Product
- HT Contact Form 7
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update HT Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Thim Elementor Kit: Missing AuthorizationCVE-2025-24725 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thim Elementor Kit: from n/a through <= 1.2.8.
- Product
- Thim Elementor Kit
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Thim Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Booking Calendar Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24723 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.55.
- Product
- Booking Calendar Contact Form
- Affected
- up to 1.2.55
- What to do
- Affects up to 1.2.55. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025FAQ Builder AYS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24722 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Stored XSS.This issue affects FAQ Builder AYS: from n/a through <= 1.7.3.
- Product
- FAQ Builder AYS
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update FAQ Builder AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Easy YouTube Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24721 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Easy YouTube Gallery easy-youtube-gallery allows Stored XSS.This issue affects Easy YouTube Gallery: from n/a through <= 1.0.4.
- Product
- Easy YouTube Gallery
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Easy YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Widget Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24719 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored XSS.This issue affects Widget Countdown: from n/a through <= 2.7.1.
- Product
- Widget Countdown
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Widget Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Plethora Plugins Tabs + Accordions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plethora Plugins Plethora Plugins Tabs + Accordions plethora-tabs-accordions allows Stored XSS.This issue affects Plethora Plugins Tabs + Accordions: from n/a through <= 1.1.5.
- Product
- Plethora Plugins Tabs + Accordions
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Plethora Plugins Tabs + Accordions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025MultiVendorX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24706 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.13.
- Product
- MultiVendorX
- Affected
- up to 4.2.13
- What to do
- Affects up to 4.2.13. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WooCommerce Quick View: Missing AuthorizationCVE-2025-24705 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arshid WooCommerce Quick View woo-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Quick View: from n/a through <= 1.1.1.
- Product
- WooCommerce Quick View
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WooCommerce Quick View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.