Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

4,962 results · page 38 of 100

Oct 25, 2025Open Source Genesis Framework: Stored Cross-Site ScriptingCVE-2025-10737 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Open Source Genesis Framework theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Open Source Genesis Framework
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Open Source Genesis Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record studiopress.github.io wordfence.com
Oct 25, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution: Stored Cross-Site ScriptingCVE-2025-11823 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2025BackWPup – WordPress Backup & Restore: Unauthorized access of dataCVE-2025-10579 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'backwpup_working' AJAX action in all versions up to, and including, 5.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve access to a back-up's filename while a backup is running. This information has little value on it's own, but could be used to aid in a brute force attack to retrieve back-up contents in limited environments (i.e. NGINX).
Product
BackWPup – WordPress Backup & Restore
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update BackWPup – WordPress Backup & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 24, 2025Simple Excel Pricelist for WooCommerce: Stored Cross-Site ScriptingCVE-2025-12096 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Excel Pricelist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricelist' shortcode in all versions up to, and including, 1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Excel Pricelist for WooCommerce
Affected
up to 1.13
What to do
Affects up to 1.13. Update Simple Excel Pricelist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2025qnotsquiz: Stored Cross-Site ScriptingCVE-2025-12016 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The qnotsquiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qnotsquiz_custom_start_text' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
qnotsquiz
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update qnotsquiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 24, 2025Time Clock – A WordPress Employee & Volunteer Time Clock: Stored Cross-Site ScriptingCVE-2025-10701 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Time Clock – A WordPress Employee & Volunteer Time Clock Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with Time Clock user credentials to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.
Product
Time Clock – A WordPress Employee & Volunteer Time Clock
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Time Clock – A WordPress Employee & Volunteer Time Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 23, 2025Bold Page Builder: Stored Cross-Site ScriptingCVE-2025-7730 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘percentage’ parameter in all versions up to, and including, 5.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.4.5
What to do
Affects up to 5.4.5. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 23, 2025Beaver Builder Plugin (Starter Version): Stored Cross-Site ScriptingCVE-2025-8427 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Beaver Builder Plugin (Starter Version)
Affected
up to 2.9.2.1
What to do
Affects up to 2.9.2.1. Update Beaver Builder Plugin (Starter Version) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbeaverbuilder.com
Oct 22, 2025WP Store Locator: Deserialization of Untrusted DataCVE-2025-52737 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Tijmen Smit WP Store Locator wp-store-locator allows Object Injection.This issue affects WP Store Locator: from n/a through <= 2.2.260.
Product
WP Store Locator
Affected
up to 2.2.260
What to do
Affects up to 2.2.260. Update WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Responsive Progress Bar: Stored Cross-Site ScriptingCVE-2025-11883 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Progress Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rprogress shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Progress Bar
What to do
Update Responsive Progress Bar to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025SM CountDown Widget: Stored Cross-Site ScriptingCVE-2025-11880 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SM CountDown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's smcountdown shortcode in versions less than, or equal to, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SM CountDown Widget
What to do
Update SM CountDown Widget to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025ST Categories Widget: Stored Cross-Site ScriptingCVE-2025-11878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ST Categories Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's st-categories shortcode in versions less than, or equal to, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ST Categories Widget
What to do
Update ST Categories Widget to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Material Design Iconic Font Integration: Stored Cross-Site ScriptingCVE-2025-11872 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Material Design Iconic Font Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdiconic' shortcode in all versions up to, and including, 2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Material Design Iconic Font Integration
Affected
up to 2
What to do
Affects up to 2. Update Material Design Iconic Font Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Simple Business Data: Stored Cross-Site ScriptingCVE-2025-11870 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Business Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'simple_business_data' shortcode attributes in all versions up to, and including, 1.0.1. This is due to the plugin not properly sanitizing user input or escaping output when embedding the `type` attribute into the `class` attribute in rendered HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Business Data
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Simple Business Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Bg Book Publisher: Stored Cross-Site ScriptingCVE-2025-11867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bg Book Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `book_author` post meta, rendered through the `[book_author]` shortcode, in all versions up to, and including, 1.25. This is due to the plugin not properly escaping the meta value before output. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bg Book Publisher
Affected
up to 1.25
What to do
Affects up to 1.25. Update Bg Book Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Photographers galleries: Stored Cross-Site ScriptingCVE-2025-11866 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photographers galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes (`w`, `h`, `raw_css`, `look`, etc.) in all versions up to, and including, 1.1.8. This is due to the plugin not properly sanitizing user input or escaping output when inserting these values into HTML attributes and inline styles. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photographers galleries
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Photographers galleries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025WP AD Gallery: Stored Cross-Site ScriptingCVE-2025-11834 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP AD Gallery
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP AD Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025WP Restaurant Listings: Stored Cross-Site ScriptingCVE-2025-11830 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Restaurant Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter of the restaurant_summary shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Restaurant Listings
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Restaurant Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Oboxmedia Ads: Stored Cross-Site ScriptingCVE-2025-11827 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_widget' and 'after_widget' parameters of the oboxads-ad-widget shortcode in all versions up to, and including, 1.9.8. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Oboxmedia Ads
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Oboxmedia Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025Playerzbr: Stored Cross-Site ScriptingCVE-2025-11825 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Playerzbr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'urlmeta' post meta field in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Playerzbr
Affected
up to 1.6
What to do
Affects up to 1.6. Update Playerzbr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025Cinza Grid: Stored Cross-Site ScriptingCVE-2025-11824 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cinza Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cgrid_skin_content' post meta field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cinza Grid
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Cinza Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025WP-Thumbnail: Stored Cross-Site ScriptingCVE-2025-11819 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'roboshot' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Thumbnail
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP-Thumbnail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025WP Responsive Meet The Team: Stored Cross-Site ScriptingCVE-2025-11818 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprm_team' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Responsive Meet The Team
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Responsive Meet The Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025Simple Tableau Viz: Stored Cross-Site ScriptingCVE-2025-11817 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Tableau Viz
Affected
up to 2.0
What to do
Affects up to 2.0. Update Simple Tableau Viz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025Responsive iframe GoogleMap: Stored Cross-Site ScriptingCVE-2025-11813 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive iframe GoogleMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive_map' shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on the 'width' and 'height' attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive iframe GoogleMap
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Responsive iframe GoogleMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025Simple Youtube Shortcode: Stored Cross-Site ScriptingCVE-2025-11811 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Youtube Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embed_youtube' shortcode in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping on the 'id' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Youtube Shortcode
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Simple Youtube Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025Print Button Shortcode: Stored Cross-Site ScriptingCVE-2025-11810 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Print Button Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'print-button' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'target' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Print Button Shortcode
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Print Button Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025WP-Force Images Download: Stored Cross-Site ScriptingCVE-2025-11809 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including, 1.8. This is due to insufficient input sanitization and output escaping on the 'class' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Force Images Download
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP-Force Images Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025Mixlr Shortcode: Stored Cross-Site ScriptingCVE-2025-11807 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mixlr Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'url' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mixlr Shortcode
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Mixlr Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025JB News Ticker: Stored Cross-Site ScriptingCVE-2025-11804 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JB News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'jbticker' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
JB News Ticker
Affected
up to 1.0
What to do
Affects up to 1.0. Update JB News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025This-or-That: Stored Cross-Site ScriptingCVE-2025-10138 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
This-or-That
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update This-or-That to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website: Stored Cross-Site ScriptingCVE-2025-12033 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pro_version_activation_code' parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
Affected
up to 3.0.10
What to do
Affects up to 3.0.10. Update Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2025-10651 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'order_mail' setting in versions up to, and including, 2.11.22. This is due to insufficient sanitization on the order_mail field and a lack of escaping on output. This makes it possible for authenticated attackers, with Editor-level permissions and above, to inject arbitrary web scripts via the General Setting page that will execute when an administrator accesses the E-mail Setting page.
Product
Welcart e-Commerce
Affected
up to 2.11.22
What to do
Affects up to 2.11.22. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org welcart.com
Oct 18, 2025Related Posts Lite: Stored Cross-Site ScriptingCVE-2025-11926 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Related Posts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Related Posts Lite
Affected
up to 1.12
What to do
Affects up to 1.12. Update Related Posts Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 18, 2025Redirection for Contact Form 7: Stored Cross-Site ScriptingCVE-2025-9562 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Redirection for Contact Form 7
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2025Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns: Stored Cross-Site ScriptingCVE-2025-11270 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2025WPBakery Page Builder: Stored Cross-Site ScriptingCVE-2025-10006 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rev_slider_vc' shortcode in all versions up to, and including, 8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when RevSlider is also installed.
Product
WPBakery Page Builder
Affected
up to 8.6
What to do
Affects up to 8.6. Update WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record kb.wpbakery.com wordfence.com
Oct 18, 2025XX2WP Integration Tools: Stored Cross-Site ScriptingCVE-2025-11857 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxp_fb2wp_display_embed' shortcode in all versions up to, and including, 1.9.9. This is due to the plugin not properly sanitizing user input and output of the 'post_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
XX2WP Integration Tools
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update XX2WP Integration Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2025Async JavaScript: Stored Cross-Site ScriptingCVE-2020-36854 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page.
Product
Async JavaScript
What to do
Update Async JavaScript to the newest version.
Full record and what to do →NVD record wordfence.com wordfence.com
Oct 18, 202510WebMapBuilder: Stored Cross-Site ScriptingCVE-2020-36853 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
10WebMapBuilder
Affected
up to 1.0.63
What to do
Affects up to 1.0.63. Update 10WebMapBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2025Ultimate Addons for WPBakery: Stored Cross-Site ScriptingCVE-2025-11814 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultimate Addons for WPBakery
Affected
up to 3.21.1
What to do
Affects up to 3.21.1. Update Ultimate Addons for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordfence.com
Oct 15, 2025DocoDoco Store Locator: Arbitrary file uploadsCVE-2025-10754 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The DocoDoco Store Locator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
DocoDoco Store Locator
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update DocoDoco Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025Find And Replace content for: Unauthorized Stored Cross-Site Scripting and Arbitrary Content ReplacementCVE-2025-10313 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the far_admin_ajax_fun() function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that can make privilege escalation and malicious redirects possible.
Product
Find And Replace content for
Affected
up to 1.1
What to do
Affects up to 1.1. Update Find And Replace content for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 15, 2025Shortcode Button: Stored Cross-Site ScriptingCVE-2025-10194 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shortcode Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Shortcode Button
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Shortcode Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 15, 2025Digiseller: Stored Cross-Site ScriptingCVE-2025-10141 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Digiseller
Affected
up to 1.3
What to do
Affects up to 1.3. Update Digiseller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025Quick Social Login: Stored Cross-Site ScriptingCVE-2025-10140 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Quick Social Login
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Quick Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 15, 2025WP BookWidgets: Stored Cross-Site ScriptingCVE-2025-10139 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP BookWidgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bw_link' shortcode in all versions up to, and including, 0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP BookWidgets
Affected
up to 0.9
What to do
Affects up to 0.9. Update WP BookWidgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025WP ViewSTL: Stored Cross-Site ScriptingCVE-2025-10135 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP ViewSTL
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP ViewSTL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 15, 2025URLYar URL Shortner: Stored Cross-Site ScriptingCVE-2025-10133 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyar_shortlink' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
URLYar URL Shortner
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update URLYar URL Shortner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2025Dhivehi Text: Stored Cross-Site ScriptingCVE-2025-10132 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dhivehi Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dhivehi' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Dhivehi Text
Affected
up to 0.1
What to do
Affects up to 0.1. Update Dhivehi Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.