Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

486new WordPress flaws this week

395,358entries in the database

24,557 results · page 302 of 492

Jan 16, 2025Contact Form 7 – CCAvenue Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23623 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Bisen Contact Form 7 – CCAvenue Add-on cf7-cc-avenue-add-on allows Reflected XSS.This issue affects Contact Form 7 – CCAvenue Add-on: from n/a through <= 1.0.
Product
Contact Form 7 – CCAvenue Add-on
Affected
up to 1.0
What to do
Affects up to 1.0. Update Contact Form 7 – CCAvenue Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Captchelfie – Captcha by Selfie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23620 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trof Captchelfie – Captcha by Selfie captchelfie-captcha-by-selfie allows Reflected XSS.This issue affects Captchelfie – Captcha by Selfie: from n/a through <= 1.0.7.
Product
Captchelfie – Captcha by Selfie
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Captchelfie – Captcha by Selfie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025LH Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Login Page lh-login-page allows Reflected XSS.This issue affects LH Login Page: from n/a through <= 2.14.
Product
LH Login Page
Affected
up to 2.14
What to do
Affects up to 2.14. Update LH Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Loginplus: Missing AuthorizationCVE-2025-23514 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Sanjay Prasad Loginplus loginplus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Loginplus: from n/a through <= 1.2.
Product
Loginplus
Affected
up to 1.2
What to do
Affects up to 1.2. Update Loginplus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Extra Options – Favicons: Cross-Site Request Forgery (CSRF)CVE-2025-23508 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in OrigoThemes Extra Options – Favicons extra-options-favicons allows Stored XSS.This issue affects Extra Options – Favicons: from n/a through <= 1.1.0.
Product
Extra Options – Favicons
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Extra Options – Favicons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Board Election: Cross-Site Request Forgery (CSRF)CVE-2025-23499 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier Board Election board-election allows Stored XSS.This issue affects Board Election: from n/a through <= 1.0.1.
Product
Board Election
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Board Election to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025WP VTiger Synchronization: Cross-Site Request Forgery (CSRF)CVE-2025-23455 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Master Software Solutions WP VTiger Synchronization msstiger allows Stored XSS.This issue affects WP VTiger Synchronization: from n/a through <= 1.1.1.
Product
WP VTiger Synchronization
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP VTiger Synchronization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Stars SMTP Mailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23453 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Reflected XSS.This issue affects Stars SMTP Mailer: from n/a through <= 1.7.
Product
Stars SMTP Mailer
Affected
up to 1.7
What to do
Affects up to 1.7. Update Stars SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025EditionGuard for WooCommerce – eBook Sales with DRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23452 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Reflected XSS.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.
Product
EditionGuard for WooCommerce – eBook Sales with DRM
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update EditionGuard for WooCommerce – eBook Sales with DRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Scroll Top Advanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23444 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Scroll Top Advanced scroll-top-advanced allows Stored XSS.This issue affects Scroll Top Advanced: from n/a through <= 2.5.
Product
Scroll Top Advanced
Affected
up to 2.5
What to do
Affects up to 2.5. Update Scroll Top Advanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025WP PT-Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23438 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat WP PT-Viewer wp-ptviewer allows Reflected XSS.This issue affects WP PT-Viewer: from n/a through <= 2.0.2.
Product
WP PT-Viewer
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update WP PT-Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Easy EU Cookie law: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viher3 Easy EU Cookie law easy-eu-cookie-law allows Stored XSS.This issue affects Easy EU Cookie law: from n/a through <= 1.3.3.1.
Product
Easy EU Cookie law
Affected
up to 1.3.3.1
What to do
Affects up to 1.3.3.1. Update Easy EU Cookie law to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025AlT Report: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23432 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlTi5 AlT Report alt-report allows Reflected XSS.This issue affects AlT Report: from n/a through <= 1.12.0.
Product
AlT Report
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update AlT Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Altima Lookbook Free for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23429 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in altima-interactive Altima Lookbook Free for WooCommerce altima-lookbook-free-for-woocommerce allows Reflected XSS.This issue affects Altima Lookbook Free for WooCommerce: from n/a through <= 1.1.0.
Product
Altima Lookbook Free for WooCommerce
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Altima Lookbook Free for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025SendGrid for: Missing AuthorizationCVE-2025-23423 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Smackcoders Inc., SendGrid for WordPress wp-sendgrid-mailer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SendGrid for WordPress: from n/a through <= 1.4.
Product
SendGrid for
Affected
up to 1.4
What to do
Affects up to 1.4. Update SendGrid for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Passwords Manager: SQL InjectionCVE-2024-12615 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX actions in all versions up to, and including, 1.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Passwords Manager
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Passwords Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2025Passwords Manager: Unauthorized modification of dataCVE-2024-12614 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_save_setting' and 'post_new_pass' AJAX actions in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and add passwords.
Product
Passwords Manager
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Passwords Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2025Passwords Manager: SQL InjectionCVE-2024-12613 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Passwords Manager plugin for WordPress is vulnerable to SQL Injection via the $wpdb->prefix value in several AJAX fuctions in all versions up to, and including, 1.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Passwords Manager
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Passwords Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 15, 2025The Motors – Car Dealer, Classifieds & Listing: Arbitrary shortcode executionCVE-2024-10970 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
The Motors – Car Dealer, Classifieds & Listing
Affected
up to 1.4.43
What to do
Affects up to 1.4.43. Update The Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 15, 2025UpdraftPlus: WP Backup & Migration: Reflected Cross-Site ScriptingCVE-2025-0215 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Product
UpdraftPlus: WP Backup & Migration
Affected
up to 1.24.12
What to do
Affects up to 1.24.12. Update UpdraftPlus: WP Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2025Neon Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22799 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through <= 2.2.0.
Product
Neon Product Designer
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Neon Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Responsive jQuery Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer Responsive jQuery Slider responsive-jquery-slider allows Stored XSS.This issue affects Responsive jQuery Slider: from n/a through <= 1.1.1.
Product
Responsive jQuery Slider
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Responsive jQuery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Gallery and Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22797 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oğulcan Özügenç Gallery and Lightbox gallery-and-lightbox allows Stored XSS.This issue affects Gallery and Lightbox: from n/a through <= 1.0.14.
Product
Gallery and Lightbox
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Gallery and Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Multilang Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22795 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Reflected XSS.This issue affects Multilang Contact Form: from n/a through <= 1.5.
Product
Multilang Contact Form
Affected
up to 1.5
What to do
Affects up to 1.5. Update Multilang Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Bold pagos en linea: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22793 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Bold pagos en linea bold-pagos-en-linea allows DOM-Based XSS.This issue affects Bold pagos en linea: from n/a through <= 3.1.4.
Product
Bold pagos en linea
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update Bold pagos en linea to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025CoDesigner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22788 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codexpert, Inc CoDesigner woolementor allows Stored XSS.This issue affects CoDesigner: from n/a through <= 4.29.
Product
CoDesigner
Affected
up to 4.29
What to do
Affects up to 4.29. Update CoDesigner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Button Block: Missing AuthorizationCVE-2025-22787 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.
Product
Button Block
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Button Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Course Booking System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22785 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system allows SQL Injection.This issue affects Course Booking System: from n/a through <= 6.0.6.
Product
Course Booking System
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update Course Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Nativery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22781 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nativery Nativery nativery allows DOM-Based XSS.This issue affects Nativery: from n/a through <= 0.1.6.
Product
Nativery
Affected
up to 0.1.6
What to do
Affects up to 0.1.6. Update Nativery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025wp-pano: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey wp-pano wp-pano allows Stored XSS.This issue affects wp-pano: from n/a through <= 1.17.
Product
wp-pano
Affected
up to 1.17
What to do
Affects up to 1.17. Update wp-pano to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025WP News Sliders: Missing AuthorizationCVE-2025-22779 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in codeaffairs WP News Sliders wp-news-sliders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP News Sliders: from n/a through <= 1.0.
Product
WP News Sliders
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP News Sliders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Lijit Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22778 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in damniel Lijit Search wp-lijit-wijit allows Reflected XSS.This issue affects Lijit Search: from n/a through <= 1.1.
Product
Lijit Search
Affected
up to 1.1
What to do
Affects up to 1.1. Update Lijit Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025WP Bulletin Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22776 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codebycarter WP Bulletin Board wp-bulletin-board allows Reflected XSS.This issue affects WP Bulletin Board: from n/a through <= 1.1.4.
Product
WP Bulletin Board
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update WP Bulletin Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Htaccess File Editor: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-22773 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Htaccess File Editor: from n/a through <= 1.0.19.
Product
Htaccess File Editor
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Htaccess File Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Multifox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22769 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Brahma Multifox allows Stored XSS.This issue affects Multifox: from n/a through 1.3.7.
Product
Multifox
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Multifox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Zarinpal Paid Download: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22766 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masoud Amini Zarinpal Paid Download zarinpal-paid-downloads allows Reflected XSS.This issue affects Zarinpal Paid Download: from n/a through <= 2.3.
Product
Zarinpal Paid Download
Affected
up to 2.3
What to do
Affects up to 2.3. Update Zarinpal Paid Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025WP Order By: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22765 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This issue affects WP Order By: from n/a through <= 1.4.2.
Product
WP Order By
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update WP Order By to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025WP Post Corrector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22764 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vipul Jariwala WP Post Corrector wp-post-corrector allows Reflected XSS.This issue affects WP Post Corrector: from n/a through <= 1.0.2.
Product
WP Post Corrector
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Post Corrector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22762 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Stored XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.
Product
WordPress HelpDesk & Support Ticket System Plugin – Octrace Support
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WordPress HelpDesk & Support Ticket System Plugin – Octrace Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Ajax Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22761 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer Ajax Contact Form fws-ajax-contact-form allows Stored XSS.This issue affects Ajax Contact Form: from n/a through <= 1.4.1.
Product
Ajax Contact Form
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025CodeBard Help Desk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Reflected XSS.This issue affects CodeBard Help Desk: from n/a through <= 1.1.2.
Product
CodeBard Help Desk
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update CodeBard Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Post and Page Builder by BoldGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22759 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Stored XSS.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.5.
Product
Post and Page Builder by BoldGrid
Affected
up to 1.27.5
What to do
Affects up to 1.27.5. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Elementor AI Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harnani Elementor AI Addons ai-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through <= 2.2.1.
Product
Elementor AI Addons
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Elementor AI Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025WP Headmaster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22755 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bavington WP Headmaster wp-headmaster allows Reflected XSS.This issue affects WP Headmaster: from n/a through <= 0.3.
Product
WP Headmaster
Affected
up to 0.3
What to do
Affects up to 0.3. Update WP Headmaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Amber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22754 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berkman Klein Center Amber amberlink allows Reflected XSS.This issue affects Amber: from n/a through <= 1.4.4.
Product
Amber
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Amber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025turboSMTP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22753 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in turboSMTP turboSMTP turbosmtp allows Reflected XSS.This issue affects turboSMTP: from n/a through <= 4.6.
Product
turboSMTP
Affected
up to 4.6
What to do
Affects up to 4.6. Update turboSMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025GSheetConnector for Forminator Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22752 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WesternDeal GSheetConnector for Forminator Forms gsheetconnector-forminator allows Reflected XSS.This issue affects GSheetConnector for Forminator Forms: from n/a through <= 1.0.12.
Product
GSheetConnector for Forminator Forms
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update GSheetConnector for Forminator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Partners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22751 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Partners partners allows Reflected XSS.This issue affects Partners: from n/a through <= 0.2.0.
Product
Partners
Affected
up to 0.2.0
What to do
Affects up to 0.2.0. Update Partners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Post Carousel & Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22750 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel Post Carousel & Slider post-types-carousel-slider allows Reflected XSS.This issue affects Post Carousel & Slider: from n/a through <= 1.0.4.
Product
Post Carousel & Slider
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Post Carousel & Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Social Media Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemesCraft.co Social Media Engine social-media-engine allows Stored XSS.This issue affects Social Media Engine: from n/a through <= 1.0.2.
Product
Social Media Engine
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Social Media Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.