Updated 48 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,491 results · page 30 of 50

Feb 7, 2025WP ALL Export Pro: Unauthorized modification of data that can lead to privilege escalationCVE-2024-7425 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input validation and sanitization in all versions up to, and including, 1.9.1. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WP ALL Export Pro
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update WP ALL Export Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 4, 2025SocialV - Social Network and Community BuddyPress: Unauthorized access of dataCVE-2024-13529 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'socialv_send_download_file' function in all versions up to, and including, 2.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download arbitrary files from the target system.
Product
SocialV - Social Network and Community BuddyPress
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update SocialV - Social Network and Community BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record assets.iqonic.design themeforest.net
Feb 3, 2025Eventer: Unauthorized access of dataCVE-2024-11134 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to download bookings, which contains customers' personal data.
Product
Eventer
Affected
up to 3.9.9
What to do
Affects up to 3.9.9. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 3, 2025Eventer: Unauthorized access of dataCVE-2024-11133 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function in all versions up to, and including, 3.9.9.5. This makes it possible for unauthenticated attackers to download event tickets.
Product
Eventer
Affected
up to 3.9.9.5
What to do
Affects up to 3.9.9.5. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 3, 2025Taxi Booking Manager for WooCommerce: Deserialization of Untrusted DataCVE-2025-24661 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.
Product
Taxi Booking Manager for WooCommerce
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Korea for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2025-24639 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Korea for WooCommerce: from n/a through <= 1.1.11.
Product
Korea for WooCommerce
Affected
up to 1.1.11
What to do
Affects up to 1.1.11. Update Korea for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 1, 2025WooCommerce Support Ticket System: Unauthorized access and loss of dataCVE-2024-13775 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list' functions in all versions up to, and including, 17.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts, and read names, emails, and capabilities of all users.
Product
WooCommerce Support Ticket System
Affected
up to 17.8
What to do
Affects up to 17.8. Update WooCommerce Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 1, 2025Custom Related Posts: Unauthorized access & modification of dataCVE-2024-12825 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actions in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to search posts and link/unlink relations.
Product
Custom Related Posts
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Custom Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 1, 2025MagicForm: Access and modification of dataCVE-2025-0939 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings.
Product
MagicForm
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update MagicForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2025RapidLoad – Optimize Web Vitals Automatically: Unauthorized modification of dataCVE-2024-13651 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_deactivate() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset some of the plugin's settings.
Product
RapidLoad – Optimize Web Vitals Automatically
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update RapidLoad – Optimize Web Vitals Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2025AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations: Unauthorized modification of dataCVE-2024-12620 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'agl_json' AJAX action in all versions up to, and including, 1.4.23. This makes it possible for unauthenticated attackers to update the plugin's settings.
Product
AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations
Affected
up to 1.4.23
What to do
Affects up to 1.4.23. Update AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 31, 2025WordPress Contact Forms by Cimatti: Unauthorized access of dataCVE-2024-12184 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the accua_forms_download_submitted_file() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to download other user submitted forms.
Product
WordPress Contact Forms by Cimatti
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update WordPress Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Barcode Generator for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2025-24597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Retrieve Embedded Sensitive Data.This issue affects Barcode Generator for WooCommerce: from n/a through <= 2.0.2.
Product
Barcode Generator for WooCommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Barcode Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025WP DataTable: Stored Cross-Site ScriptingCVE-2024-13566 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 0.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP DataTable
Affected
up to 0.2.6
What to do
Affects up to 0.2.6. Update WP DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Contact Form and Calls To Action by vcita: Unauthorized modification of dataCVE-2024-13717 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact functions in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to enabled and disable widgets.
Product
Contact Form and Calls To Action by vcita
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Contact Form and Calls To Action by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025zStore Manager Basic: Unauthorized loss of dataCVE-2024-13715 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstore_clear_cache() function in all versions up to, and including, 3.311. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's cache.
Product
zStore Manager Basic
Affected
up to 3.311
What to do
Affects up to 3.311. Update zStore Manager Basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025ECPay Ecommerce for WooCommerce: Unauthorized loss of dataCVE-2024-13652 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clear_ecpay_debug_log' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's log files.
Product
ECPay Ecommerce for WooCommerce
Affected
up to 1.1.2411060
What to do
Affects up to 1.1.2411060. Update ECPay Ecommerce for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 30, 2025Single-user-chat: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13646 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the 'single_user_chat_update_login' function in all versions up to, and including, 0.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update option values to 'login' on the WordPress site. This may be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Product
Single-user-chat
Affected
up to 0.5
What to do
Affects up to 0.5. Update Single-user-chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025Media Manager for UserPro: Unauthorized modification of data that can lead to privilege escalationCVE-2024-12822 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the add_capto_img() function in all versions up to, and including, 3.11.0. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Media Manager for UserPro
Affected
up to 3.11.0
What to do
Affects up to 3.11.0. Update Media Manager for UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jan 30, 2025Media Manager for UserPro: Unauthorized modification of data that can lead to privilege escalationCVE-2024-12821 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the upm_upload_media() function in all versions up to, and including, 3.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Media Manager for UserPro
Affected
up to 3.12.0
What to do
Affects up to 3.12.0. Update Media Manager for UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jan 30, 2025Safe Ai Malware Protection for WP: Unauthorized access of dataCVE-2024-12269 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db() function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the site's database.
Product
Safe Ai Malware Protection for WP
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update Safe Ai Malware Protection for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Royal Core: Unauthorized modification of data that can lead to privilege escalationCVE-2024-12129 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Royal Core plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'royal_restore_backup' function in all versions up to, and including, 2.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Royal Core
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Royal Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 30, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Unauthorized loss of dataCVE-2024-11583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_zipped_font' function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete icon fonts that were previously uploaded.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics: Unauthorized modification of data that can lead to privilege escalationCVE-2024-10591 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hubwoo_save_updates() function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2025Save as PDF: Deserialization of Untrusted DataCVE-2025-24671 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through <= 4.4.0.
Product
Save as PDF
Affected
up to 4.4.0
What to do
Affects up to 4.4.0. Update Save as PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 27, 2025FundPress: Deserialization of Untrusted DataCVE-2025-24601 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0.6.
Product
FundPress
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update FundPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 26, 2025Zox News: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11936 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' function in all versions up to, and including, 3.16.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Zox News
Affected
up to 3.16.0
What to do
Affects up to 3.16.0. Update Zox News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: Unauthorized modification of dataCVE-2024-10574 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ays_save_google_credentials' function in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This makes it possible for unauthenticated attackers to modify the Google Sheets integration credentials within the plugin's settings. Because the 'client_id' parameter is not sanitized or escaped when used in output, this vulnerability could also be leveraged to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Quiz Maker Business, Developer, and Agency
Affected
up to 8.8.0
What to do
Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ays-pro.com ays-pro.com
Jan 25, 2025Boom Fest: Unauthorized modification of dataCVE-2024-13449 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bf_admin_action' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings that change the appearance of the website.
Product
Boom Fest
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Boom Fest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025GoHero Store Customizer for WooCommerce: Unauthorized modification of dataCVE-2024-12826 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooh_action_settings_save_frontend() function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to update limited plugin settings.
Product
GoHero Store Customizer for WooCommerce
Affected
up to 3.5
What to do
Affects up to 3.5. Update GoHero Store Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 25, 2025Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized loss of dataCVE-2024-12113 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_user_review() and delete_review() functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's reviews.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 24, 2025JSM Show Post Metadata: Missing AuthorizationCVE-2025-24589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through <= 4.6.0.
Product
JSM Show Post Metadata
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update JSM Show Post Metadata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 202512 Step Meeting List: Insertion of Sensitive Information Into Sent DataCVE-2025-24582 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
Product
12 Step Meeting List
Affected
up to 3.16.5
What to do
Affects up to 3.16.5. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Jobify - Job Board: Unauthorized access and modification of dataCVE-2024-13698 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_ai' and 'generate_image_via_ai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload files in an image format, and to generate AI images using the site's OpenAI key.
Product
Jobify - Job Board
Affected
up to 4.2.7
What to do
Affects up to 4.2.7. Update Jobify - Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 23, 2025MDTF – Meta Data and Taxonomies Filter: Stored Cross-Site ScriptingCVE-2024-13340 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdf_results_by_ajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MDTF – Meta Data and Taxonomies Filter
Affected
up to 1.3.3.6
What to do
Affects up to 1.3.3.6. Update MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025Muzaara Google Ads Report: Deserialization of Untrusted DataCVE-2025-23914 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through <= 3.1.
Product
Muzaara Google Ads Report
Affected
up to 3.1
What to do
Affects up to 3.1. Update Muzaara Google Ads Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WOOEXIM: Deserialization of Untrusted DataCVE-2025-23944 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.
Product
WOOEXIM
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Quick Count: Deserialization of Untrusted DataCVE-2025-23932 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <= 3.00.
Product
Quick Count
Affected
up to 3.00
What to do
Affects up to 3.00. Update Quick Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WM Options Import Export: Insertion of Sensitive Information Into Sent DataCVE-2025-23781 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensitive Data.This issue affects WM Options Import Export: from n/a through <= 1.0.1.
Product
WM Options Import Export
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WM Options Import Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WPDB to Sql: Insertion of Sensitive Information Into Sent DataCVE-2025-23774 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affects WPDB to Sql: from n/a through <= 1.2.
Product
WPDB to Sql
Affected
up to 1.2
What to do
Affects up to 1.2. Update WPDB to Sql to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Database Sync: Missing AuthorizationCVE-2025-23486 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tamlyn Database Sync database-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database Sync: from n/a through <= 0.5.1.
Product
Database Sync
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update Database Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WP Hotel Booking: Unauthorized access of dataCVE-2024-13447 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a list of registered user emails.
Product
WP Hotel Booking
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025WPBot Pro Wordpress Chatbot: Unauthorized modification of dataCVE-2024-12879 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qc_wp_latest_update_check_pro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create Simple Text Responses to chat queries.
Product
WPBot Pro Wordpress Chatbot
Affected
up to 13.5.5
What to do
Affects up to 13.5.5. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbot.pro
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49699 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
Product
ARPrice
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49688 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
Product
ARPrice
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Visual Website Collaboration, Feedback & Project Management – Atarim: Unauthorized loss of dataCVE-2024-12104 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpf_delete_file and wpf_delete_file functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attackers to delete project pages and files. CVE-2025-22657 may be a duplicate of this issue.
Product
Visual Website Collaboration, Feedback & Project Management – Atarim
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2025Buzz Club – Night Club, DJ and Music Festival Event: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-0515 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Product
Buzz Club – Night Club, DJ and Music Festival Event
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Buzz Club – Night Club, DJ and Music Festival Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 17, 2025Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media: Unauthorized loss of dataCVE-2024-12071 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_network_post() function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages.
Product
Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 17, 2025WP Hotel Booking: Unauthorized modification of dataCVE-2024-12370 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to add rooms with custom prices.
Product
WP Hotel Booking
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2025WordPress Data Guard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23828 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sindhi WordPress Data Guard wordpress-data-guards allows Stored XSS.This issue affects WordPress Data Guard: from n/a through <= 8.
Product
WordPress Data Guard
Affected
up to 8
What to do
Affects up to 8. Update WordPress Data Guard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.