Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

321 results · page 3 of 7

May 26, 2025Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2025-4682 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML attributes in Slider and Post Carousel widgets in all versions up to, and including, 5.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 5.4.0
What to do
Affects up to 5.4.0. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 7, 2025Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-12120 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget display_message_text parameter in all versions up to, and including, 1.7.1017 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1017
What to do
Affects up to 1.7.1017. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 26, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites
Affected
up to 5.10.29
What to do
Affects up to 5.10.29. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2025UiCore Elements – Free Elementor widgets and templates: Stored Cross-Site ScriptingCVE-2025-1054 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the UI Counter, UI Icon Box, UI Testimonial Slider, UI Testimonial Grid, and UI Testimonial Carousel widgets in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UiCore Elements – Free Elementor widgets and templates
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update UiCore Elements – Free Elementor widgets and templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 19, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1457 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Wrapper Link, Countdown and Gallery widgets in all versions up to, and including, 5.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites
Affected
up to 5.10.28
What to do
Affects up to 5.10.28. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Stored Cross-Site ScriptingCVE-2025-2225 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rael_title_tag' parameter in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 1.6.9.
Product
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 12, 2025Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-1456 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1012
What to do
Affects up to 1.7.1012. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 12, 2025Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-1455 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Woo Grid widget in all versions up to, and including, 1.7.1012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1012
What to do
Affects up to 1.7.1012. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2025Gutena Kit – Gutenberg Blocks and Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31805 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Gutena Kit – Gutenberg Blocks and Templates gutena-kit allows Stored XSS.This issue affects Gutena Kit – Gutenberg Blocks and Templates: from n/a through <= 2.0.7.
Product
Gutena Kit – Gutenberg Blocks and Templates
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Gutena Kit – Gutenberg Blocks and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Post Custom Templates Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31767 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through <= 1.14.
Product
Post Custom Templates Lite
Affected
up to 1.14
What to do
Affects up to 1.14. Update Post Custom Templates Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025PowerPack Elementor Addons (Free Widgets, Extensions and Templates): Stored Cross-Site ScriptingCVE-2025-1512 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Cursor Extension in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update PowerPack Elementor Addons (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2025WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder: Stored Cross-Site ScriptingCVE-2024-12189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom widgets in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that you may need to recreate any custom widgets or reinstall the plugin to ensure the issue is adequately patched.
Product
WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Sensitive Information ExposureCVE-2025-2228 · WordPress plugins & themes · reported by WordfenceMedium 5.7
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.8 the 'register_user' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Edit Login | Registration Form widget, as long as that user opens the email notification for successful registration.
Product
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28875 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Stored XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.6.
Product
BP Email Assign Templates
Affected
up to 1.6
What to do
Affects up to 1.6. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025BP Email Assign Templates: Authorization Bypass Through User-Controlled KeyCVE-2025-28874 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Email Assign Templates: from n/a through <= 1.7.
Product
BP Email Assign Templates
Affected
up to 1.7
What to do
Affects up to 1.7. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 8, 2025Starter Templates by FancyWP: Blind Server-Side Request ForgeryCVE-2024-13924 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'http_request_host_is_external' filter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Starter Templates by FancyWP
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Starter Templates by FancyWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2025-1664 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Parallax slider in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Stored Cross-Site ScriptingCVE-2025-1287 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown, Syntax Highlighter, and Page Scroll widgets in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 6.2.2
What to do
Affects up to 6.2.2. Update The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2025TemplatesNext ToolKit: Stored Cross-Site ScriptingCVE-2024-13559 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tx_woo_wishlist_table' shortcode in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TemplatesNext ToolKit
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update TemplatesNext ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 26, 2025The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2025-1517 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 26, 2025Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2024-13803 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-marker’ parameter in all versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost plugins.trac.wordpress.org
Feb 22, 2025Rife Elementor Extensions & Templates: Stored Cross-Site ScriptingCVE-2024-13564 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Writing Effect Headline shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rife Elementor Extensions & Templates
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Rife Elementor Extensions & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 21, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Local File InclusionCVE-2024-13353 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.4 via several widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2025-1441 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wpr_filter_woo_products' function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1007
What to do
Affects up to 1.7.1007. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 15, 2025Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive: Server-Side Request ForgeryCVE-2024-13834 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remote_request' function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2025Starter Templates by FancyWP: Cross-Site Request Forgery (CSRF)CVE-2025-25106 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP starter-templates allows Cross Site Request Forgery.This issue affects Starter Templates by FancyWP: from n/a through <= 2.0.0.
Product
Starter Templates by FancyWP
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Starter Templates by FancyWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025BP Email Assign Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Reflected XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.5.
Product
BP Email Assign Templates
Affected
up to 1.5
What to do
Affects up to 1.5. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 1, 2025The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Stored Cross-Site ScriptingCVE-2024-11829 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Widget's searchable_label parameter in all versions up to, and including, 6.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 6.1.8
What to do
Affects up to 6.1.8. Update The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2024-10867 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 30, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Remote Code ExecutionCVE-2024-11600 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.6.0 via the 'write_config' function. This is due to a lack of sanitization on an imported JSON file. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Unauthorized loss of dataCVE-2024-11583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_zipped_font' function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete icon fonts that were previously uploaded.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2025Starter Templates: Cross-Site Request Forgery (CSRF)CVE-2025-24568 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates astra-sites allows Cross Site Request Forgery.This issue affects Starter Templates: from n/a through <= 4.4.9.
Product
Starter Templates
Affected
up to 4.4.9
What to do
Affects up to 4.4.9. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Stored Cross-Site ScriptingCVE-2024-13354 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in several widgets in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2025Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates: Unauthorized accessCVE-2024-13335 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoder_theme_install_func() function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install a theme.
Product
Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2025Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2025-0393 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1006
What to do
Affects up to 1.7.1006. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through <= 2.1.4.
Product
Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2025Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2024-12045 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maker title value of the Google Maps block in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025TemplatesNext ToolKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marsian TemplatesNext ToolKit templatesnext-toolkit allows Stored XSS.This issue affects TemplatesNext ToolKit: from n/a through <= 3.2.9.
Product
TemplatesNext ToolKit
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update TemplatesNext ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements: Information ExposureCVE-2024-12140 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft templates that they should not have access to.
Product
Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025WPKoi Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56241 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Stored XSS.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.1.3.
Product
WPKoi Templates for Elementor
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update WPKoi Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024eTemplates: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55972 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.
Product
eTemplates
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update eTemplates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Stored Cross-Site ScriptingCVE-2024-10784 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.126
What to do
Affects up to 1.5.126. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024BP Email Assign Templates: Reflected Cross-Site ScriptingCVE-2024-12441 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2025-24631 is likely a duplicate of this.
Product
BP Email Assign Templates
Affected
up to 1.5
What to do
Affects up to 1.5. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024ABCBiz Addons and Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54247 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABCBiz ABCBiz Addons and Templates for Elementor allows Stored XSS.This issue affects ABCBiz Addons and Templates for Elementor: from n/a through 2.0.2.
Product
ABCBiz Addons and Templates for Elementor
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update ABCBiz Addons and Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Rife Elementor Extensions & Templates: Missing AuthorizationCVE-2023-27454 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Rife Elementor Extensions & Templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rife Elementor Extensions & Templates: from n/a through 1.1.10.
Product
Rife Elementor Extensions & Templates
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Rife Elementor Extensions & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Reflected Cross-Site ScriptingCVE-2024-11436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
Affected
up to 1.4.19
What to do
Affects up to 1.4.19. Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024PowerPack Elementor Addons (Free Widgets, Extensions and Templates): Information ExposureCVE-2024-10692 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 via the Content Reveal widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update PowerPack Elementor Addons (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 30, 2024Softtemplates For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53764 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftHopper Softtemplates For Elementor softtemplates-for-elementor allows DOM-Based XSS.This issue affects Softtemplates For Elementor: from n/a through <= 1.0.8.
Product
Softtemplates For Elementor
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Softtemplates For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024Royal Elementor Addons and Templates: Information ExposureCVE-2024-10798 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1003
What to do
Affects up to 1.7.1003. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2024The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin foCVE-2024-11601 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the save_options() function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note this is limited to option values that can be saved as arrays.
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.