Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
476 results · page 4 of 10
Jan 14, 2026Flat Shipping Rate by City for WooCommerce: Time-based SQL InjectionCVE-2026-0678 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Flat Shipping Rate by City for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'cities' parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Flat Shipping Rate by City for WooCommerce
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Flat Shipping Rate by City for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 10, 2026Countdown Timer – Widget Countdown: Stored Cross-Site ScriptingCVE-2025-14555 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdevart_countdown' shortcode in all versions up to, and including, 2.7.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Countdown Timer – Widget Countdown
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update Countdown Timer – Widget Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2026Timetics: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-67915 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.
- Product
- Timetics
- Affected
- up to 1.0.46
- What to do
- Affects up to 1.0.46. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Time-based SQL InjectionCVE-2025-9318 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Affected
- up to 10.3.1
- What to do
- Affects up to 10.3.1. Update Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 6, 2026Appointment Booking and Scheduling Calendar Plugin – WP Timetics: Unauthorized access and modification of dataCVE-2025-5919 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and register_routes functions in all versions up to, and including, 1.0.36. This makes it possible for unauthenticated attackers to view and modify booking details.
- Product
- Appointment Booking and Scheduling Calendar Plugin – WP Timetics
- Affected
- up to 1.0.36
- What to do
- Affects up to 1.0.36. Update Appointment Booking and Scheduling Calendar Plugin – WP Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2026Page Expire Popup/Redirection for: Time-based SQL InjectionCVE-2025-14153 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Page Expire Popup/Redirection for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' shortcode attribute in all versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Page Expire Popup/Redirection for
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Page Expire Popup/Redirection for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 31, 2025History Timeline: Missing AuthorizationCVE-2025-62150 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themesawesome History Timeline timeline-awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects History Timeline: from n/a through <= 1.0.6.
- Product
- History Timeline
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update History Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025MX Time Zone Clocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62146 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maksym Marko MX Time Zone Clocks mx-time-zone-clocks allows Stored XSS.This issue affects MX Time Zone Clocks: from n/a through <= 5.1.1.
- Product
- MX Time Zone Clocks
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update MX Time Zone Clocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Time Slots Booking Form: Missing AuthorizationCVE-2025-68569 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.39.
- Product
- WP Time Slots Booking Form
- Affected
- up to 1.2.39
- What to do
- Affects up to 1.2.39. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Bold Timeline Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Stored XSS.This issue affects Bold Timeline Lite: from n/a through <= 1.2.7.
- Product
- Bold Timeline Lite
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Bold Timeline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Timetics: Missing AuthorizationCVE-2025-64268 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.44.
- Product
- Timetics
- Affected
- up to 1.0.44
- What to do
- Affects up to 1.0.44. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67983 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows DOM-Based XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 8.3.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 8.3
- What to do
- Affects up to 8.3. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 15, 2025Booking Calendar: Time-based blind SQL InjectionCVE-2025-14383 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and including, 10.14.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Booking Calendar
- Affected
- up to 10.14.8
- What to do
- Affects up to 10.14.8. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 13, 2025افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce: Time-based blind SQL InjectionCVE-2025-13077 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordowasp.orgplugins.trac.wordpress.org
Dec 12, 2025FunnelKit - Funnel Builder for WooCommerce Checkout: Time-based blind SQL InjectionCVE-2025-14169 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- FunnelKit - Funnel Builder for WooCommerce Checkout
- Affected
- up to 3.13.1.5
- What to do
- Affects up to 3.13.1.5. Update FunnelKit - Funnel Builder for WooCommerce Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2025WPNakama: Time-based SQL InjectionCVE-2025-14068 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions up to, and including, 0.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WPNakama
- Affected
- up to 0.6.3
- What to do
- Affects up to 0.6.3. Update WPNakama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcwe.mitre.orgplugins.trac.wordpress.org
Dec 11, 2025Bold Timeline Lite: Stored Cross-Site ScriptingCVE-2025-14032 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bold Timeline Lite
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Bold Timeline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 10, 2025List category posts: Time-based SQL InjectionCVE-2025-10163 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shortcode in all versions up to, and including, 0.91.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- List category posts
- Affected
- up to 0.91.0
- What to do
- Affects up to 0.91.0. Update List category posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2025Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: Time-based blind SQL InjectionCVE-2025-13922 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint in all versions up to, and including, 3.40.1. This is due to insufficient escaping on user-supplied parameters and lack of SQL query parameterization. This makes it possible for authenticated attackers, with Contributor-level access and above who have AI metabox permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, cause performance degradation, or enable data inference through time-based techniques.
- Product
- Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
- Affected
- up to 3.40.1
- What to do
- Affects up to 3.40.1. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 5, 2025Time Sheets: Cross-Site Request ForgeryCVE-2025-10055 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Time Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on several endpoints. This makes it possible for unauthenticated attackers to perform a variety of actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Time Sheets
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Time Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 3, 2025Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: Time-based SQL InjectionCVE-2025-13359 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database granted they have metabox access for the taxonomy (enabled by default for contributors).
- Product
- Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
- Affected
- up to 3.40.1
- What to do
- Affects up to 3.40.1. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Dec 3, 2025Timetable and Event Schedule by MotoPress: Does not verify a user has access to a specific eventCVE-2025-12954 · WordPress plugins & themes · reported by WPScanLow 2.7
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.
- Product
- Timetable and Event Schedule by MotoPress
- Fixed in
- 2.4.16
- What to do
- Update Timetable and Event Schedule by MotoPress to 2.4.16 or newer.
Dec 2, 2025VikRentCar Car Rental Management System: Time-based blind SQL InjectionCVE-2025-13724 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'month' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- VikRentCar Car Rental Management System
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2025Bookme – Free Online Appointment Booking and Scheduling: Time-based SQL InjectionCVE-2025-13385 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Bookme – Free Online Appointment Booking and Scheduling
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Bookme – Free Online Appointment Booking and Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2025ProjectList: Time-based SQL InjectionCVE-2025-13370 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- ProjectList
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update ProjectList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordit.wordpress.orgplugins.trac.wordpress.org
Nov 24, 2025Perfect Brands for WooCommerce: Time-based SQL InjectionCVE-2025-10144 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Perfect Brands for WooCommerce
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update Perfect Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 24, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Time-based SQL InjectionCVE-2025-7402 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in all versions up to, and including, 4.95 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.95
- What to do
- Affects up to 4.95. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 19, 2025Booking Plugin for WordPress Appointments – Time Slot: Unauthorized email sendingCVE-2025-12842 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1.4.7 due to missing validation on the tslot_appt_email AJAX action. This makes it possible for unauthenticated attackers to send appointment notification emails to arbitrary recipients with attacker-controlled text content in certain email fields, potentially enabling the site to be abused for phishing campaigns or spam distribution.
- Product
- Booking Plugin for WordPress Appointments – Time Slot
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Booking Plugin for WordPress Appointments – Time Slot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2025Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager: Time-based SQL InjectionCVE-2025-8994 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘completed_at_operator’ parameter in all versions up to, and including, 2.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager
- Affected
- up to 2.6.26
- What to do
- Affects up to 2.6.26. Update Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 10, 2025WP Count Down Timer: Stored Cross-Site ScriptingCVE-2025-12668 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Count Down Timer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Count Down Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 10, 2025Skip to Timestamp: Stored Cross-Site ScriptingCVE-2025-11805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Skip to Timestamp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skipto' shortcode in all versions up to, and including, 1.4.4. This is due to insufficient input sanitization and output escaping on the 'time' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Skip to Timestamp
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Skip to Timestamp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 6, 2025Real Time Validation for Gravity Forms: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48330 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows PHP Local File Inclusion.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.
- Product
- Real Time Validation for Gravity Forms
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Real Time Validation for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2025All in One Time Clock Lite: Unauthorized accessCVE-2025-11758 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check without capability checks. This makes it possible for unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules).
- Product
- All in One Time Clock Lite
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update All in One Time Clock Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2025wpForo Forum: Error‐based or time-based SQL InjectionCVE-2025-4203 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'row_count' parameters. The function blindly interpolates 'row_count' into a 'LIMIT offset,row_count' clause using esc_sql() rather than enforcing numeric values. MySQL 5.x’s grammar allows a 'PROCEDURE ANALYSE' clause immediately after a LIMIT clause. Unauthenticated attackers controlling 'row_count' can append a stored‐procedure call, enabling error‐based or time‐based blind SQL injection that can be used to extract sensitive information from the database.
- Product
- wpForo Forum
- Affected
- up to 2.4.8
- What to do
- Affects up to 2.4.8. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2025Time Clock – A WordPress Employee & Volunteer Time Clock: Stored Cross-Site ScriptingCVE-2025-10701 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Time Clock – A WordPress Employee & Volunteer Time Clock Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with Time Clock user credentials to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.
- Product
- Time Clock – A WordPress Employee & Volunteer Time Clock
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Time Clock – A WordPress Employee & Volunteer Time Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2025WPC Countdown Timer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49908 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through <= 3.1.4.
- Product
- WPC Countdown Timer for WooCommerce
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update WPC Countdown Timer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier: Insecure Direct Object ReferenceCVE-2025-6833 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber access and above, to clock other users in and out.
- Product
- All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 11, 2025Custom 404 Pro: Time-based SQL InjectionCVE-2025-9947 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Custom 404 Pro
- Affected
- up to 3.12.0
- What to do
- Affects up to 3.12.0. Update Custom 404 Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 22, 2025Product Time Countdown for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57908 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Product Time Countdown for WooCommerce product-countdown-for-woocommerce allows Stored XSS.This issue affects Product Time Countdown for WooCommerce: from n/a through <= 1.6.5.
- Product
- Product Time Countdown for WooCommerce
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Product Time Countdown for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2025The Events Calendar: Time-based SQL InjectionCVE-2025-9807 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- The Events Calendar
- Affected
- up to 6.15.1
- What to do
- Affects up to 6.15.1. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 11, 2025Time Tracker: Unauthorized modification and loss of dataCVE-2025-9018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_function' and 'tt_delete_record_function' functions in all versions up to, and including, 3.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update options such as user registration and default role, allowing anyone to register as an Administrator, and to delete limited data from the database.
- Product
- Time Tracker
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Time Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2025Smartcat Translator for WPML: Time-based SQL InjectionCVE-2025-9451 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Smartcat Translator for WPML plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 3.1.72 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Smartcat Translator for WPML
- Affected
- up to 3.1.72
- What to do
- Affects up to 3.1.72. Update Smartcat Translator for WPML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2025Countdown Timer for Elementor: Stored Cross-Site ScriptingCVE-2025-8445 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Countdown Timer for Elementor
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Countdown Timer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 11, 2025CatFolders – Tame Your WordPress Media Library by Category: Time-based SQL InjectionCVE-2025-9776 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- CatFolders – Tame Your WordPress Media Library by Category
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update CatFolders – Tame Your WordPress Media Library by Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2025Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net: Time-based SQL InjectionCVE-2025-9463 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 1.117.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net
- Affected
- up to 1.117.5
- What to do
- Affects up to 1.117.5. Update Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2025Duplicate Page and Post: Time-based SQL InjectionCVE-2025-6189 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Duplicate Page and Post plugin for WordPress is vulnerable to time-based SQL Injection via the ‘meta_key’ parameter in all versions up to, and including, 2.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Duplicate Page and Post
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update Duplicate Page and Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 5, 2025UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Time-based SQL InjectionCVE-2025-10003 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘upload_file_remove’ function and 'htmlvar' parameter in all versions up to, and including, 1.2.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
- Affected
- up to 1.2.44
- What to do
- Affects up to 1.2.44. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 4, 2025Easy Timer: Remote Code ExecutionCVE-2025-9519 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server.
- Product
- Easy Timer
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Easy Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2025iATS Online Forms: Time-based SQL InjectionCVE-2025-9441 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- iATS Online Forms
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update iATS Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 28, 2025Simple Download Monitor: Time-based SQL InjectionCVE-2025-8977 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple Download Monitor plugin for WordPress is vulnerable to time-based SQL Injection via the order parameter in all versions up to, and including, 3.9.33 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Simple Download Monitor
- Affected
- up to 3.9.33
- What to do
- Affects up to 3.9.33. Update Simple Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.