Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

4,962 results · page 37 of 100

Nov 10, 2025Magazine Companion: Stored Cross-Site ScriptingCVE-2025-11828 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using user-supplied values as HTML tag names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Magazine Companion
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Magazine Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025WP Bootstrap Tabs: Stored Cross-Site ScriptingCVE-2025-11822 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Bootstrap Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bootstrap_tab' shortcode in all versions up to, and including, 1.0.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Bootstrap Tabs
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WP Bootstrap Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Woocommerce – Products By Custom Tax: Stored Cross-Site ScriptingCVE-2025-11821 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Woocommerce – Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'woo_products_custom_tax' shortcode in all versions up to, and including, 2.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Woocommerce – Products By Custom Tax
Affected
up to 2.2
What to do
Affects up to 2.2. Update Woocommerce – Products By Custom Tax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Skip to Timestamp: Stored Cross-Site ScriptingCVE-2025-11805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Skip to Timestamp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skipto' shortcode in all versions up to, and including, 1.4.4. This is due to insufficient input sanitization and output escaping on the 'time' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Skip to Timestamp
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Skip to Timestamp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Include Fussball.de Widgets: Stored Cross-Site ScriptingCVE-2025-11129 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Include Fussball.de Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api' and 'type' parameters in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Include Fussball.de Widgets
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Include Fussball.de Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025aThemes Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-12837 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user-supplied values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
aThemes Addons for Elementor
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025Saphali LiqPay for donate: Stored Cross-Site ScriptingCVE-2025-12643 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Saphali LiqPay for donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saphali_liqpay' shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Saphali LiqPay for donate
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Saphali LiqPay for donate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2025HTML Forms – Simple WordPress Forms: Stored Cross-Site ScriptingCVE-2025-12125 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
HTML Forms – Simple WordPress Forms
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update HTML Forms – Simple WordPress Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025Insert Headers and Footers Code – HT Script: Stored Cross-Site ScriptingCVE-2025-12112 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Insert Headers and Footers Code – HT Script
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Insert Headers and Footers Code – HT Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025WP Airbnb Review Slider: Stored Cross-Site ScriptingCVE-2025-12520 · WordPress plugins & themes · reported by WordfenceMedium 4
The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Airbnb Review Slider
Affected
up to 4.2
What to do
Affects up to 4.2. Update WP Airbnb Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cyberresearchhub.com cyberresearchhub.com
Nov 6, 2025WooCommerce Store Toolkit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60204 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach WooCommerce Store Toolkit woocommerce-store-toolkit allows PHP Local File Inclusion.This issue affects WooCommerce Store Toolkit: from n/a through <= 2.4.3.
Product
WooCommerce Store Toolkit
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update WooCommerce Store Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Store Exporter: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60203 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach Store Exporter woocommerce-exporter allows PHP Local File Inclusion.This issue affects Store Exporter: from n/a through <= 2.7.6.
Product
Store Exporter
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update Store Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025GoStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup GoStore gostore allows Reflected XSS.This issue affects GoStore: from n/a through < 1.6.4.
Product
GoStore
What to do
Update GoStore to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 5, 2025Ad Inserter – Ad Manager & AdSense Ads: Stored Cross-Site ScriptingCVE-2025-11745 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field through the plugin's 'adinserter' shortcode in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ad Inserter – Ad Manager & AdSense Ads
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update Ad Inserter – Ad Manager & AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2025Visual Link Preview: Stored Cross-Site ScriptingCVE-2025-11987 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visual Link Preview
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Visual Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2025Graphina – Elementor Charts and Graphs: Stored Cross-Site ScriptingCVE-2025-11820 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Graphina – Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widgets in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping on data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects multiple chart widgets including Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart, and Advance Data Table widgets.
Product
Graphina – Elementor Charts and Graphs
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Graphina – Elementor Charts and Graphs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Nov 5, 2025Spectra Gutenberg Blocks – Website Builder for the Block Editor: Stored Cross-Site ScriptingCVE-2025-11162 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2.19.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spectra Gutenberg Blocks – Website Builder for the Block Editor
Affected
up to 2.19.14
What to do
Affects up to 2.19.14. Update Spectra Gutenberg Blocks – Website Builder for the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025MeetingList: Stored Cross-Site ScriptingCVE-2025-12184 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The MeetingList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
MeetingList
Affected
up to 0.11
What to do
Affects up to 0.11. Update MeetingList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.com wordfence.com
Nov 4, 2025Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Stored Cross-Site ScriptingCVE-2025-12045 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category and tag 'name' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025Pagerank Tools: Stored Cross-Site ScriptingCVE-2025-12416 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the pr_save_settings() function and insufficient input sanitization. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses the plugin's settings page.
Product
Pagerank Tools
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Pagerank Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025clubmember: Stored Cross-Site ScriptingCVE-2025-12396 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The clubmember plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
clubmember
Affected
up to 0.2
What to do
Affects up to 0.2. Update clubmember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.com wordfence.com
Nov 4, 2025Free Quotation: Stored Cross-Site ScriptingCVE-2025-12393 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Free Quotation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Free Quotation
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Free Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 4, 2025Nari Accountant: Stored Cross-Site ScriptingCVE-2025-12371 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Nari Accountant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via account settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Nari Accountant
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Nari Accountant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 4, 2025Extensions for Leaflet Map: Stored Cross-Site ScriptingCVE-2025-12369 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Extensions for Leaflet Map
Affected
up to 4.7
What to do
Affects up to 4.7. Update Extensions for Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025WP Carticon: Stored Cross-Site ScriptingCVE-2025-12065 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Carticon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carticon_js_script' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Carticon
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Carticon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 4, 2025Reuse Builder: Stored Cross-Site ScriptingCVE-2025-11812 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Reuse Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reuse_builder_single_post_title' shortcode in all versions up to, and including, 1.7. This is due to insufficient input sanitization and output escaping on the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Reuse Builder
Affected
up to 1.7
What to do
Affects up to 1.7. Update Reuse Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 4, 2025Bootstrap Multi-language Responsive Portfolio: Stored Cross-Site ScriptingCVE-2025-11753 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Bootstrap Multi-language Responsive Portfolio
Affected
up to 1.0
What to do
Affects up to 1.0. Update Bootstrap Multi-language Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Nov 4, 2025Footnotes Made Easy: Stored Cross-Site ScriptingCVE-2025-11733 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Footnotes Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Footnotes Made Easy
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Footnotes Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2025TablePress – Tables in WordPress made easy: Stored Cross-Site ScriptingCVE-2025-12324 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `table` shortcode attributes in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TablePress – Tables in WordPress made easy
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update TablePress – Tables in WordPress made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 3, 2025Greenshift – animation and page builder blocks: Stored Cross-Site ScriptingCVE-2025-11841 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versions up to, and including, 12.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Greenshift – animation and page builder blocks
Affected
up to 12.2.7
What to do
Affects up to 12.2.7. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2025kallyas: Stored Cross-Site ScriptingCVE-2025-6988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 4.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
kallyas
Affected
up to 4.23.0
What to do
Affects up to 4.23.0. Update kallyas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record my.hogash.com wordfence.com
Nov 1, 2025Employee Spotlight – Team Member Showcase & Meet the Team: Stored Cross-Site ScriptingCVE-2025-12090 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Employee Spotlight – Team Member Showcase & Meet the Team
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update Employee Spotlight – Team Member Showcase & Meet the Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2025Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2025-11502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.51
What to do
Affects up to 1.51. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2025Schema Scalpel: Stored Cross-Site ScriptingCVE-2025-12118 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping when outputting user-supplied data into JSON-LD schema markup. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Schema Scalpel
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Schema Scalpel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 1, 2025Community Events: Stored Cross-Site ScriptingCVE-2025-11995 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Community Events
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Community Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2025Flying Images: Optimize and Lazy Load Images for Faster Page Speed: Stored Cross-Site ScriptingCVE-2025-11927 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Flying Images: Optimize and Lazy Load Images for Faster Page Speed
Affected
up to 2.4.14
What to do
Affects up to 2.4.14. Update Flying Images: Optimize and Lazy Load Images for Faster Page Speed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Nov 1, 2025CSS & JavaScript Toolbox: Stored Cross-Site ScriptingCVE-2025-11928 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
CSS & JavaScript Toolbox
Affected
up to 12.0.5
What to do
Affects up to 12.0.5. Update CSS & JavaScript Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 31, 2025Inactive Logout: Stored Cross-Site ScriptingCVE-2025-11922 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Inactive Logout
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Inactive Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 30, 2025Qzzr Shortcode: Stored Cross-Site ScriptingCVE-2025-11806 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Qzzr Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qzzr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'quiz' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Qzzr Shortcode
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Qzzr Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 30, 2025Blocksy Companion: Stored Cross-Site ScriptingCVE-2025-12475 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shortcode in all versions up to, and including, 2.1.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Blocksy Companion
Affected
up to 2.1.14
What to do
Affects up to 2.1.14. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 29, 2025Super Store Finder: Cross-Site Request Forgery (CSRF)CVE-2025-58939 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in highwarden Super Store Finder superstorefinder-wp allows Cross Site Request Forgery.This issue affects Super Store Finder: from n/a through <= 7.5.
Product
Super Store Finder
Affected
up to 7.5
What to do
Affects up to 7.5. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Open Close WooCommerce Store: Missing AuthorizationCVE-2025-62935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Close WooCommerce Store: from n/a through <= 5.0.0.
Product
Open Close WooCommerce Store
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2025The7 — Website and eCommerce Builder for: Stored Cross-Site ScriptingCVE-2025-11897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The7 — Website and eCommerce Builder for WordPress theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ the7_fancy_title_css’ parameter in all versions up to, and including, 12.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The7 — Website and eCommerce Builder for
Affected
up to 12.9.1
What to do
Affects up to 12.9.1. Update The7 — Website and eCommerce Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 25, 2025Fast Velocity Minify: Stored Cross-Site ScriptingCVE-2025-12034 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Fast Velocity Minify
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Fast Velocity Minify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 25, 2025SpendeOnline.org: Stored Cross-Site ScriptingCVE-2025-11875 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SpendeOnline.org plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spendeonline' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SpendeOnline.org
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update SpendeOnline.org to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2025Widget Options – The #1 WordPress Widget & Block Control: Stored Cross-Site ScriptingCVE-2025-10580 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Widget Options – The #1 WordPress Widget & Block Control
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Widget Options – The #1 WordPress Widget & Block Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2025Testimonial Carousel For Elementor: Stored Cross-Site ScriptingCVE-2025-8666 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions less than, or equal to, 11.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Testimonial Carousel For Elementor
What to do
Update Testimonial Carousel For Elementor to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2025Gutenberg Blocks – PublishPress Blocks: Stored Cross-Site ScriptingCVE-2025-8588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenberg Blocks – PublishPress Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Marker Title' and 'Marker Description' parameters for the Maps block in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenberg Blocks – PublishPress Blocks
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update Gutenberg Blocks – PublishPress Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 25, 2025Listeo: Stored Cross-Site ScriptingCVE-2025-8413 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Listeo theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `soundcloud` shortcode in version less than, or equal to, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Listeo
What to do
Update Listeo to the newest version.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 25, 2025Watu Quiz: Stored Cross-Site ScriptingCVE-2025-11238 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal to, 3.4.4 due to insufficient input sanitization and output escaping when the "Save source URL" option is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an user accesses an injected page.
Product
Watu Quiz
What to do
Update Watu Quiz to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.