Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

4,962 results · page 40 of 100

Sep 30, 2025Big Post Shipping for WooCommerce: Stored Cross-Site ScriptingCVE-2025-10191 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Big Post Shipping for WooCommerce
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Big Post Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025BP Direct Menus: Stored Cross-Site ScriptingCVE-2025-10189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdm_login' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BP Direct Menus
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update BP Direct Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025dbview: Stored Cross-Site ScriptingCVE-2025-10182 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
dbview
Affected
up to 0.5.5
What to do
Affects up to 0.5.5. Update dbview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025My AskAI: Stored Cross-Site ScriptingCVE-2025-10179 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My AskAI
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update My AskAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025Any News Ticker: Stored Cross-Site ScriptingCVE-2025-10168 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shortcode in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Any News Ticker
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Any News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 30, 2025All Social Share Options: Stored Cross-Site ScriptingCVE-2025-10131 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All Social Share Options
Affected
up to 1.0
What to do
Affects up to 1.0. Update All Social Share Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025Layers: Stored Cross-Site ScriptingCVE-2025-10130 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Layers
Affected
up to 0.5
What to do
Affects up to 0.5. Update Layers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025Eulerpool Research Systems: Stored Cross-Site ScriptingCVE-2025-10128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Eulerpool Research Systems
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Eulerpool Research Systems to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2025WP Statistics – The Most Popular Privacy-Friendly Analytics: Stored Cross-Site ScriptingCVE-2025-9816 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Statistics – The Most Popular Privacy-Friendly Analytics
Affected
up to 14.5.4
What to do
Affects up to 14.5.4. Update WP Statistics – The Most Popular Privacy-Friendly Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 26, 2025Team Members: Stored Cross-Site ScriptingCVE-2025-8440 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team Members plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first and last name fields in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Team Members
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update Team Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025XStore: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-60100 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.
Product
XStore
What to do
Update XStore to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Zephyr Project Manager: Stored Cross-Site ScriptingCVE-2025-10490 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Zephyr Project Manager
Affected
up to 3.3.202
What to do
Affects up to 3.3.202. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 26, 2025Backuply – Backup, Restore, Migrate and Clone: Arbitrary file deletionCVE-2025-10307 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 26, 2025Markdown Shortcode: Stored Cross-Site ScriptingCVE-2025-10180 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Markdown Shortcode
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Markdown Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 26, 2025TweetThis Shortcode: Stored Cross-Site ScriptingCVE-2025-10136 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TweetThis Shortcode
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update TweetThis Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Sep 26, 2025Popup Maker: Stored Cross-Site ScriptingCVE-2025-9490 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Popup Maker
Affected
up to 1.20.6
What to do
Affects up to 1.20.6. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025Mapster WP Maps: Stored Cross-Site ScriptingCVE-2025-9044 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mapster WP Maps
Affected
up to 1.20.0
What to do
Affects up to 1.20.0. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2025Widgets for Tiktok Feed: Stored Cross-Site ScriptingCVE-2025-8906 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Widgets for Tiktok Feed
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Widgets for Tiktok Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 25, 2025Mega Elements – Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-8200 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mega Elements – Addons for Elementor
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Mega Elements – Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 25, 2025CM Business Directory: Stored Cross-Site ScriptingCVE-2025-10178 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CM Business Directory
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update CM Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2025Themify Builder: Stored Cross-Site ScriptingCVE-2025-9353 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.6.9.
Product
Themify Builder
Affected
up to 7.6.9
What to do
Affects up to 7.6.9. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2025Widget Options - Extended: Stored Cross-Site ScriptingCVE-2025-8902 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Widget Options - Extended
Affected
up to 5.2.1
What to do
Affects up to 5.2.1. Update Widget Options - Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record widget-options.com wordfence.com
Sep 22, 2025Ultimate Store Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58017 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.8.6.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 20, 2025Draft List: Stored Cross-Site ScriptingCVE-2025-10181 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Draft List
Affected
up to 2.6
What to do
Affects up to 2.6. Update Draft List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 18, 2025Ghost Kit – Page Builder Blocks, Motion Effects & Extensions: Stored Cross-Site ScriptingCVE-2025-9992 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ghost Kit – Page Builder Blocks, Motion Effects & Extensions
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Ghost Kit – Page Builder Blocks, Motion Effects & Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 17, 2025Blocksy Companion: Stored Cross-Site ScriptingCVE-2025-9565 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksy_newsletter_subscribe shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Blocksy Companion
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2025StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More: Arbitrary file uploadsCVE-2025-9216 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import() function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 17, 2025StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More: Path TraversalCVE-2025-9215 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the file_download() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 17, 2025Media Player Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-9203 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Player Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_artist_name' parameters in version 1.0.5. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Media Player Addons for Elementor
What to do
Update Media Player Addons for Elementor to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2025Memberlite Shortcodes: Stored Cross-Site ScriptingCVE-2025-10125 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Memberlite Shortcodes
Affected
up to 1.4
What to do
Affects up to 1.4. Update Memberlite Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 16, 2025Appointmind: Stored Cross-Site ScriptingCVE-2025-9851 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Appointmind plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appointmind_calendar' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Appointmind
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Appointmind to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 16, 2025Productive Style: Stored Cross-Site ScriptingCVE-2025-8394 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_productive_breadcrumb shortcode in all versions up to, and including, 1.1.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Productive Style
Affected
up to 1.1.23
What to do
Affects up to 1.1.23. Update Productive Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Sep 16, 2025Social Media Shortcodes: Stored Cross-Site ScriptingCVE-2025-10166 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twitter' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Media Shortcodes
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Social Media Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 12, 2025Spotify Embed Creator: Stored Cross-Site ScriptingCVE-2025-9879 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spotify Embed Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotify' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spotify Embed Creator
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Spotify Embed Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 12, 2025Embed Google Datastudio: Stored Cross-Site ScriptingCVE-2025-9877 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Google Datastudio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'egds' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Embed Google Datastudio
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Embed Google Datastudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025ThemeLoom Widgets: Stored Cross-Site ScriptingCVE-2025-9861 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ThemeLoom Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'los_showposts' shortcode in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ThemeLoom Widgets
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update ThemeLoom Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025Mixtape: Stored Cross-Site ScriptingCVE-2025-9860 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mixtape plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mixtape' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mixtape
Affected
up to 1.1
What to do
Affects up to 1.1. Update Mixtape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025Enhanced BibliPlug: Stored Cross-Site ScriptingCVE-2025-9855 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Enhanced BibliPlug plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bibliplug_authors' shortcode in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Enhanced BibliPlug
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Enhanced BibliPlug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025Evenium: Stored Cross-Site ScriptingCVE-2025-9850 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Evenium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'evenium_single_event' shortcode in all versions up to, and including, 1.3.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Evenium
Affected
up to 1.3.11
What to do
Affects up to 1.3.11. Update Evenium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025eID Easy: Stored Cross-Site ScriptingCVE-2025-9128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The eID Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
eID Easy
Affected
up to 4.9.3
What to do
Affects up to 4.9.3. Update eID Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025CBX Map for Google Map & OpenStreetMap: Stored Cross-Site ScriptingCVE-2025-9123 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CBX Map for Google Map & OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup heading and location address parameters in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CBX Map for Google Map & OpenStreetMap
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update CBX Map for Google Map & OpenStreetMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 11, 2025Workable Api: Stored Cross-Site ScriptingCVE-2025-8721 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Workable Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's workable_jobs shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Workable Api
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Workable Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 11, 2025WP Scriptcase: Stored Cross-Site ScriptingCVE-2025-8691 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Scriptcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Scriptcase
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Scriptcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 11, 2025Elements Plus!: Stored Cross-Site ScriptingCVE-2025-8689 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elements Plus!
Affected
up to 2.16.4
What to do
Affects up to 2.16.4. Update Elements Plus! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 11, 2025WP Easy FAQs: Stored Cross-Site ScriptingCVE-2025-8686 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Easy FAQs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WP_EASY_FAQ shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Easy FAQs
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP Easy FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Sep 11, 2025Countdown Timer for Elementor: Stored Cross-Site ScriptingCVE-2025-8445 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Countdown Timer for Elementor
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Countdown Timer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025azurecurve BBCode: Stored Cross-Site ScriptingCVE-2025-8398 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
azurecurve BBCode
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update azurecurve BBCode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 11, 2025Mitfahrgelegenheit: Stored Cross-Site ScriptingCVE-2025-8392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mitfahrgelegenheit
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Mitfahrgelegenheit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 11, 2025Jobify: Stored Cross-Site ScriptingCVE-2025-8318 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jobify
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Jobify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 11, 2025Certifica WP: Stored Cross-Site ScriptingCVE-2025-8316 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Certifica WP
Affected
up to 3.1
What to do
Affects up to 3.1. Update Certifica WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.