Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

487new WordPress flaws this week

395,358entries in the database

24,557 results · page 298 of 492

Jan 22, 2025LocalGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23678 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Imranur Rahman LocalGrid localgrid allows Reflected XSS.This issue affects LocalGrid: from n/a through <= 1.0.1.
Product
LocalGrid
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update LocalGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025LH Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23676 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Email lh-email allows Reflected XSS.This issue affects LH Email: from n/a through <= 1.12.
Product
LH Email
Affected
up to 1.12
What to do
Affects up to 1.12. Update LH Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Bit.ly linker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23674 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andygauk Bit.ly linker bitly-linker allows Reflected XSS.This issue affects Bit.ly linker: from n/a through <= 1.1.
Product
Bit.ly linker
Affected
up to 1.1
What to do
Affects up to 1.1. Update Bit.ly linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Instant Appointment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23672 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tenteeglobal Instant Appointment instant-appointment allows Reflected XSS.This issue affects Instant Appointment: from n/a through <= 1.2.
Product
Instant Appointment
Affected
up to 1.2
What to do
Affects up to 1.2. Update Instant Appointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025ReadMe Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23643 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in a.ankit ReadMe Creator readme-creator allows Reflected XSS.This issue affects ReadMe Creator: from n/a through <= 1.0.
Product
ReadMe Creator
Affected
up to 1.0
What to do
Affects up to 1.0. Update ReadMe Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Content Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Lewis Content Planner content-planner allows Reflected XSS.This issue affects Content Planner: from n/a through <= 1.0.
Product
Content Planner
Affected
up to 1.0
What to do
Affects up to 1.0. Update Content Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Cyber Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23630 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Irshad A.Khan Cyber Slider cyber-new-slider allows Reflected XSS.This issue affects Cyber Slider: from n/a through <= 1.1.
Product
Cyber Slider
Affected
up to 1.1
What to do
Affects up to 1.1. Update Cyber Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Unique UX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23625 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode Unique UX unique-ux allows Reflected XSS.This issue affects Unique UX: from n/a through <= 0.9.2.
Product
Unique UX
Affected
up to 0.9.2
What to do
Affects up to 0.9.2. Update Unique UX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WH Cache & Security: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webhue WH Cache & Security wh-cache-and-security allows Reflected XSS.This issue affects WH Cache & Security: from n/a through <= 1.1.2.
Product
WH Cache & Security
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WH Cache & Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Ultimate Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23610 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tehsmash Ultimate Events ultimate-events allows Reflected XSS.This issue affects Ultimate Events: from n/a through <= 1.3.3.
Product
Ultimate Events
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Ultimate Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Tagesteller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Helle1 Tagesteller tagesteller allows Reflected XSS.This issue affects Tagesteller: from n/a through <= v.1.1.
Product
Tagesteller
What to do
Update Tagesteller to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025CAMOO SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camoo Sarl CAMOO SMS camoo-sms allows Reflected XSS.This issue affects CAMOO SMS: from n/a through <= 3.0.1.
Product
CAMOO SMS
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update CAMOO SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Calendi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23606 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sebkay Calendi calendi allows Reflected XSS.This issue affects Calendi: from n/a through <= 1.1.1.
Product
Calendi
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Calendi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Call To Action Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lampd Call To Action Popup call-to-action-popup allows Reflected XSS.This issue affects Call To Action Popup: from n/a through <= 1.0.2.
Product
Call To Action Popup
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Call To Action Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Rezdy Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23604 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maeve Lander Rezdy Reloaded reloaded-rezdy allows Stored XSS.This issue affects Rezdy Reloaded: from n/a through <= 1.0.1.
Product
Rezdy Reloaded
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Rezdy Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Group category creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23603 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MohammadJafar Khajeh Group category creator group-category-creator allows Reflected XSS.This issue affects Group category creator: from n/a through <= 1.3.0.3.
Product
Group category creator
Affected
up to 1.3.0.3
What to do
Affects up to 1.3.0.3. Update Group category creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025EELV Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23602 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Reflected XSS.This issue affects EELV Newsletter: from n/a through <= 4.8.2.
Product
EELV Newsletter
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update EELV Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Tab My Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23601 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patrice Tab My Content tab-my-content allows Reflected XSS.This issue affects Tab My Content: from n/a through <= 1.0.0.
Product
Tab My Content
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Tab My Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Rio Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sabareesha Rio Photo Gallery rio-photo-gallery allows Reflected XSS.This issue affects Rio Photo Gallery: from n/a through <= 0.1.
Product
Rio Photo Gallery
Affected
up to 0.1
What to do
Affects up to 0.1. Update Rio Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025dForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23592 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in animexxx dForms dforms allows Reflected XSS.This issue affects dForms: from n/a through <= 1.0.
Product
dForms
Affected
up to 1.0
What to do
Affects up to 1.0. Update dForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025ContentOptin Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23589 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markugwuanyi ContentOptin Lite contentoptin allows Reflected XSS.This issue affects ContentOptin Lite: from n/a through <= 1.1.
Product
ContentOptin Lite
Affected
up to 1.1
What to do
Affects up to 1.1. Update ContentOptin Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Explara Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23583 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Explara Explara Membership explara-membership allows Reflected XSS.This issue affects Explara Membership: from n/a through <= 0.0.7.
Product
Explara Membership
Affected
up to 0.0.7
What to do
Affects up to 0.0.7. Update Explara Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Custom CSS Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Custom CSS Addons css-addons allows Reflected XSS.This issue affects Custom CSS Addons: from n/a through <= 1.9.1.
Product
Custom CSS Addons
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Custom CSS Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025XLSXviewer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-23562 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pitinca XLSXviewer xlsx-viewer allows Path Traversal.This issue affects XLSXviewer: from n/a through <= 2.1.1.
Product
XLSXviewer
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update XLSXviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Responsivity: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bilal TAS Responsivity responsivity allows Reflected XSS.This issue affects Responsivity: from n/a through <= 0.0.6.
Product
Responsivity
Affected
up to 0.0.6
What to do
Affects up to 0.0.6. Update Responsivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025REAL WordPress Sidebar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23535 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martin_ziegert REAL WordPress Sidebar drag-and-drop-custom-sidebar allows Stored XSS.This issue affects REAL WordPress Sidebar: from n/a through <= 0.1.
Product
REAL WordPress Sidebar
Affected
up to 0.1
What to do
Affects up to 0.1. Update REAL WordPress Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Team 118GROUP Agent: Missing AuthorizationCVE-2025-23512 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in 118group Team 118GROUP Agent team-118group-agent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team 118GROUP Agent: from n/a through <= 1.6.0.
Product
Team 118GROUP Agent
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Team 118GROUP Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025HyperComments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23509 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in siteheart HyperComments comments-with-hypercommentscom allows Reflected XSS.This issue affects HyperComments: from n/a through <= 0.9.6.
Product
HyperComments
Affected
up to 0.9.6
What to do
Affects up to 0.9.6. Update HyperComments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Blrt WP Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blrt Blrt WP Embed blrt-wp-embed allows Reflected XSS.This issue affects Blrt WP Embed: from n/a through <= 1.6.9.
Product
Blrt WP Embed
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Blrt WP Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WP IMAP Auth: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23506 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imsoftware WP IMAP Auth wp-imap-authentication allows Reflected XSS.This issue affects WP IMAP Auth: from n/a through <= 4.0.1.
Product
WP IMAP Auth
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP IMAP Auth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Customizable Captcha and Contact Us: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23503 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osolwordpress Customizable Captcha and Contact Us customizable-captcha-and-contact-us-form allows Reflected XSS.This issue affects Customizable Captcha and Contact Us: from n/a through <= 1.0.2.
Product
Customizable Captcha and Contact Us
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Customizable Captcha and Contact Us to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Simple Custom post type custom field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23500 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faaiq Simple Custom post type custom field simple-content-construction-kit allows Reflected XSS.This issue affects Simple Custom post type custom field: from n/a through <= 1.0.3.
Product
Simple Custom post type custom field
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Simple Custom post type custom field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Translation.Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23498 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ContentLocalized Translation.Pro translation-pro allows Reflected XSS.This issue affects Translation.Pro: from n/a through <= 1.0.0.
Product
Translation.Pro
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Translation.Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WooCommerce Order Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23495 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chetan Khandla WooCommerce Order Search woocommerce-order-searching allows Reflected XSS.This issue affects WooCommerce Order Search: from n/a through <= 1.1.0.
Product
WooCommerce Order Search
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WooCommerce Order Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Database Sync: Missing AuthorizationCVE-2025-23486 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tamlyn Database Sync database-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database Sync: from n/a through <= 0.5.1.
Product
Database Sync
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update Database Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025History timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23475 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fireantology History timeline history-timeline allows Reflected XSS.This issue affects History timeline: from n/a through <= 0.7.2.
Product
History timeline
Affected
up to 0.7.2
What to do
Affects up to 0.7.2. Update History timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025FWD Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23462 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anil Jailta FWD Slider fwd-slider allows Reflected XSS.This issue affects FWD Slider: from n/a through <= 1.0.
Product
FWD Slider
Affected
up to 1.0
What to do
Affects up to 1.0. Update FWD Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Simple shortcode buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23449 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpuc Simple shortcode buttons simple-shortcode-buttons allows Reflected XSS.This issue affects Simple shortcode buttons: from n/a through <= 1.3.2.
Product
Simple shortcode buttons
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Simple shortcode buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Mapbox for WP Advanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22772 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stephanemartinw Mapbox for WP Advanced mapbox-for-wp-advanced allows Reflected XSS.This issue affects Mapbox for WP Advanced: from n/a through <= 1.0.0.
Product
Mapbox for WP Advanced
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Mapbox for WP Advanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Arbitrary shortcode executionCVE-2024-13499 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_do_shortcode() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Time-based SQL InjectionCVE-2024-13496 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was previously published as being fixed in version 7.2.2 which was incorrect. The correct fixed version is 7.3.2.
Product
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.3.1
Fixed in
7.2.2
What to do
Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to 7.2.2 or newer.
Full record and what to do →NVD record abrahack.com plugins.trac.wordpress.org
Jan 22, 2025The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Arbitrary shortcode executionCVE-2024-13495 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipress_ajax_get_logs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025AI Power: Complete AI Pack: PHP Object InjectionCVE-2025-0429 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_ai_forms() function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AI Power: Complete AI Pack: PHP Object InjectionCVE-2025-0428 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_prompts function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AdForest: Authentication bypassCVE-2024-12857 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as any user as long as they have configured OTP login by phone number.
Product
AdForest
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 22, 2025WPBot Pro Wordpress Chatbot: Unauthorized modification of dataCVE-2024-12879 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qc_wp_latest_update_check_pro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create Simple Text Responses to chat queries.
Product
WPBot Pro Wordpress Chatbot
Affected
up to 13.5.5
What to do
Affects up to 13.5.5. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbot.pro
Jan 21, 2025WP-Polls: SQL InjectionCVE-2024-13426 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries. Those queries are stored and results are not displayed to the attacker, which means they cannot be exploited to obtain any additional information about the database. However, a properly configured payload allows for the injection of malicious JavaScript resulting in Stored Cross-Site Scripting.
Product
WP-Polls
Affected
up to 2.77.2
What to do
Affects up to 2.77.2. Update WP-Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 21, 2025Estatebud – Properties & Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23994 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings estatebud-properties-listings allows Stored XSS.This issue affects Estatebud – Properties & Listings: from n/a through <= 5.5.0.
Product
Estatebud – Properties & Listings
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Estatebud – Properties & Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025BizLibrary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23580 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew BizLibrary bizlibrary allows Reflected XSS.This issue affects BizLibrary: from n/a through <= 1.1.
Product
BizLibrary
Affected
up to 1.1
What to do
Affects up to 1.1. Update BizLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025SexBundle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23551 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp SexBundle sexbundle allows Reflected XSS.This issue affects SexBundle: from n/a through <= 1.4.
Product
SexBundle
Affected
up to 1.4
What to do
Affects up to 1.4. Update SexBundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.