Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

490new WordPress flaws this week

397,270entries in the database

24,558 results · page 305 of 492

Jan 9, 2025MG Parallax Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22330 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Parallax Slider mg-parallax-slider allows Reflected XSS.This issue affects MG Parallax Slider: from n/a through <= 1.0..
Product
MG Parallax Slider
Affected
up to 1.0.
What to do
Affects up to 1.0.. Update MG Parallax Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025Widgetize Pages Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22313 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
Product
Widgetize Pages Light
Affected
up to 3.0
What to do
Affects up to 3.0. Update Widgetize Pages Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025Product Table for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22307 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam Product Table for WooCommerce woo-product-table allows Reflected XSS.This issue affects Product Table for WooCommerce: from n/a through <= 4.0.3.
Product
Product Table for WooCommerce
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Product Table for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22295 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through <= 8.0.6.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.6
What to do
Affects up to 8.0.6. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025Greenshift – animation and page builder blocks: Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site ScriptingCVE-2024-6155 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.
Product
Greenshift – animation and page builder blocks
Affected
up to 9.0.0
What to do
Affects up to 9.0.0. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025MIMO Woocommerce Order Tracking: Unauthorized modification of dataCVE-2024-5769 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add, update, and delete shipper tracking settings.
Product
MIMO Woocommerce Order Tracking
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update MIMO Woocommerce Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025Newsletter2Go: Unauthorized modification of dataCVE-2024-12618 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in all versions up to, and including, 4.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset styles.
Product
Newsletter2Go
Affected
up to 4.0.14
What to do
Affects up to 4.0.14. Update Newsletter2Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025Bitly's: Unauthorized modification of dataCVE-2024-12616 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bitly's WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and retrieve plugin settings.
Product
Bitly's
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update Bitly's to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025Action Network: Reflected Cross-Site ScriptingCVE-2024-12394 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Action Network plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Action Network
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Action Network to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 9, 2025WP Database Backup – Unlimited Database & Files Backup by Backup for WP: Sensitive Information ExposureCVE-2024-12330 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database.
Product
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
Affected
up to 7.3
What to do
Affects up to 7.3. Update WP Database Backup – Unlimited Database & Files Backup by Backup for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025GS Insever Portfolio: Unauthorized modification of dataCVE-2024-12249 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings.
Product
GS Insever Portfolio
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update GS Insever Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025WP Travel – Ultimate Travel Booking System, Tour Management Engine: SQL InjectionCVE-2024-12067 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'booking_itinerary' parameter of the 'wptravel_get_booking_data' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Travel – Ultimate Travel Booking System, Tour Management Engine
Affected
up to 10.0.0
What to do
Affects up to 10.0.0. Update WP Travel – Ultimate Travel Booking System, Tour Management Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPreCVE-2024-11642 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.4.12 via the 'locate_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The file included must have a .php extension.
Affected
up to 3.4.12
What to do
Affects up to 3.4.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025BU Section Editing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12736 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
BU Section Editing
Affected
up to 0.9.9
What to do
Affects up to 0.9.9. Update BU Section Editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 8, 2025Shopping Cart & eCommerce Store: Unauthorized modification of dataCVE-2024-12712 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the webhook function in all versions up to, and including, 5.7.8. This makes it possible for unauthenticated attackers to modify order statuses.
Product
Shopping Cart & eCommerce Store
Affected
up to 5.7.8
What to do
Affects up to 5.7.8. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2025AdForest: Unauthorized modification of dataCVE-2024-12855 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_ad' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete posts, attachments and deactivate a license.
Product
AdForest
Affected
up to 5.1.7
What to do
Affects up to 5.1.7. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 8, 2025Cost Calculator Builder PRO: Blind time-based SQL InjectionCVE-2024-11939 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘data’ parameter in all versions up to, and including, 3.2.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Cost Calculator Builder PRO
Affected
up to 3.2.15
What to do
Affects up to 3.2.15. Update Cost Calculator Builder PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com wordfence.com
Jan 8, 2025AdForest: Privilege escalationCVE-2024-11350 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password through the adforest_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
AdForest
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 8, 2025WordPress File Upload: Remote Code ExecutionCVE-2024-11635 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server.
Product
WordPress File Upload
Affected
up to 4.24.12
What to do
Affects up to 4.24.12. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record abrahack.com plugins.svn.wordpress.org
Jan 8, 2025140+ Widgets | Xpro Addons For Elementor – FREE: Sensitive Information ExposureCVE-2024-12584 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6.2 via the 'duplicate' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.
Product
140+ Widgets | Xpro Addons For Elementor – FREE
Affected
up to 1.4.6.2
What to do
Affects up to 1.4.6.2. Update 140+ Widgets | Xpro Addons For Elementor – FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2025WordPress File Upload: Remote Code Execution, Arbitrary File Read, and Arbitrary File DeletionCVE-2024-11613 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfu_file_downloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and allowing a user-defined directory path. This makes it possible for unauthenticated attackers to execute code on the server.
Product
WordPress File Upload
Affected
up to 4.24.15
What to do
Affects up to 4.24.15. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record abrahack.com plugins.svn.wordpress.org
Jan 8, 2025MDTF – Meta Data and Taxonomies Filter: SQL InjectionCVE-2024-12030 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MDTF – Meta Data and Taxonomies Filter
Affected
up to 1.3.3.5
What to do
Affects up to 1.3.3.5. Update MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 8, 2025WordPress Webinar Plugin – WebinarPress: Modification of dataCVE-2024-11271 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on several functions in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify webinars.
Product
WordPress Webinar Plugin – WebinarPress
Affected
up to 1.33.24
What to do
Affects up to 1.33.24. Update WordPress Webinar Plugin – WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2025WordPress Webinar Plugin – WebinarPress: Arbitrary file creationCVE-2024-11270 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import-imgs' function and missing file type validation in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files that can lead to remote code execution.
Product
WordPress Webinar Plugin – WebinarPress
Affected
up to 1.33.24
What to do
Affects up to 1.33.24. Update WordPress Webinar Plugin – WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025SureForms – Drag and Drop Form Builder for: Information ExposureCVE-2024-12713 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to.
Product
SureForms – Drag and Drop Form Builder for
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification and retrieval of dataCVE-2024-11916 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with
Product
The Ultimate WordPress Toolkit – WP Extended
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Ultimate WordPress Toolkit – WP Extended: Remote Code Execution in version 3CVE-2024-11816 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpext_handle_snippet_update' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server providing an admin has created at least one code snippet.
Product
Ultimate WordPress Toolkit – WP Extended
Fixed in
3.0.12
What to do
Update Ultimate WordPress Toolkit – WP Extended to 3.0.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Alpha Price Table For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22500 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ali Ali Alpha Price Table For Elementor alpha-price-table-for-elementor allows DOM-Based XSS.This issue affects Alpha Price Table For Elementor: from n/a through <= 1.2.0.
Product
Alpha Price Table For Elementor
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Alpha Price Table For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025EMC2 Alert Boxes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric McNiece EMC2 Alert Boxes allows Stored XSS.This issue affects EMC2 Alert Boxes: from n/a through 1.3.
Product
EMC2 Alert Boxes
Affected
up to 1.3
What to do
Affects up to 1.3. Update EMC2 Alert Boxes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Allada T-shirt Designer for Woocommerce: Missing AuthorizationCVE-2025-22363 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hermann LAHAMI Allada T-shirt Designer for Woocommerce allada-tshirt-designer-for-woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through <= 1.1.
Product
Allada T-shirt Designer for Woocommerce
Affected
up to 1.1
What to do
Affects up to 1.1. Update Allada T-shirt Designer for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Digi Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Themes Digi Store allows DOM-Based XSS.This issue affects Digi Store: from n/a through 1.1.4.
Product
Digi Store
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Digi Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Ultimate Learning Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22350 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpIndeed Ultimate Learning Pro allows SQL Injection.This issue affects Ultimate Learning Pro: from n/a through 3.9.
Product
Ultimate Learning Pro
Affected
up to 3.9
What to do
Affects up to 3.9. Update Ultimate Learning Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Education LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FilaThemes Education LMS allows Stored XSS.This issue affects Education LMS: from n/a through 0.0.7.
Product
Education LMS
Affected
up to 0.0.7
What to do
Affects up to 0.0.7. Update Education LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Social Media Share Buttons | MashShare: Missing AuthorizationCVE-2025-22319 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in DearHive Social Media Share Buttons | MashShare.This issue affects Social Media Share Buttons | MashShare: from n/a through 4.0.47.
Product
Social Media Share Buttons | MashShare
Affected
up to 4.0.47
What to do
Affects up to 4.0.47. Update Social Media Share Buttons | MashShare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Link Whisper Free: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-22306 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Spencer Haws Link Whisper Free link-whisper.This issue affects Link Whisper Free: from n/a through <= 0.7.7.
Product
Link Whisper Free
Affected
up to 0.7.7
What to do
Affects up to 0.7.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Hash Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22296 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Hash Elements hash-elements.This issue affects Hash Elements: from n/a through <= 1.5.0.
Product
Hash Elements
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Hash Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Hide Category by User Role for WooCommerce: Missing AuthorizationCVE-2024-56272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce hide-category-by-user-role-for-woocommerce.This issue affects Hide Category by User Role for WooCommerce: from n/a through <= 2.1.1.
Product
Hide Category by User Role for WooCommerce
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Hide Category by User Role for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP SecureSubmit: Missing AuthorizationCVE-2024-56270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Retrieve Embedded Sensitive Data.This issue affects WP SecureSubmit: from n/a through <= 1.5.20.
Product
WP SecureSubmit
Affected
up to 1.5.20
What to do
Affects up to 1.5.20. Update WP SecureSubmit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Laika Pedigree Tree: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22593 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burria Laika Pedigree Tree laika-pedigree-tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through <= 1.4.
Product
Laika Pedigree Tree
Affected
up to 1.4
What to do
Affects up to 1.4. Update Laika Pedigree Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22592 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
Product
1003 Mortgage Application
Affected
up to 1.87
What to do
Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
Product
1003 Mortgage Application
Affected
up to 1.87
What to do
Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Ultimate Image Hover Effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Ultimate Image Hover Effects ultimate-image-hover-effects allows DOM-Based XSS.This issue affects Ultimate Image Hover Effects: from n/a through <= 1.1.2.
Product
Ultimate Image Hover Effects
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Ultimate Image Hover Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Timeline Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22584 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Timeline Pro timeline-pro allows DOM-Based XSS.This issue affects Timeline Pro: from n/a through <= 1.3.
Product
Timeline Pro
Affected
up to 1.3
What to do
Affects up to 1.3. Update Timeline Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Arcade Ready: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22581 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bytephp Arcade Ready arcadeready allows Stored XSS.This issue affects Arcade Ready: from n/a through <= 1.1.
Product
Arcade Ready
Affected
up to 1.1
What to do
Affects up to 1.1. Update Arcade Ready to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Biltorvet Dealer Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22580 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Auto IT Biltorvet Dealer Tools biltorvet-dealer-tools allows Stored XSS.This issue affects Biltorvet Dealer Tools: from n/a through <= 1.0.22.
Product
Biltorvet Dealer Tools
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update Biltorvet Dealer Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP Header Notification: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22579 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly WP Header Notification wp-header-notification allows Stored XSS.This issue affects WP Header Notification: from n/a through <= 1.2.7.
Product
WP Header Notification
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WP Header Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP Cookie: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22578 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through <= 1.0.0.
Product
WP Cookie
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Cookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Able Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22577 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damion Armentrout Able Player wp-able-player allows DOM-Based XSS.This issue affects Able Player: from n/a through <= 1.0.
Product
Able Player
Affected
up to 1.0
What to do
Affects up to 1.0. Update Able Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025ICS Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleanshooter ICS Button ics-button allows Stored XSS.This issue affects ICS Button: from n/a through <= 0.6.
Product
ICS Button
Affected
up to 0.6
What to do
Affects up to 0.6. Update ICS Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Icons Enricher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in copist Icons Enricher icons-enricher allows Stored XSS.This issue affects Icons Enricher: from n/a through <= 1.0.8.
Product
Icons Enricher
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Icons Enricher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.