Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

41,587 results · page 409 of 832

Mar 11, 2025Google News Editors Picks Feed Generator: Cross-Site Request Forgery (CSRF)CVE-2025-28860 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS.This issue affects Google News Editors Picks Feed Generator: from n/a through <= 2.1.
Product
Google News Editors Picks Feed Generator
Affected
up to 2.1
What to do
Affects up to 2.1. Update Google News Editors Picks Feed Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Maintenance Notice: Cross-Site Request Forgery (CSRF)CVE-2025-28859 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CodeVibrant Maintenance Notice maintenance-notice allows Cross Site Request Forgery.This issue affects Maintenance Notice: from n/a through <= 1.0.6.
Product
Maintenance Notice
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Maintenance Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Rankchecker.io Integration: Cross-Site Request Forgery (CSRF)CVE-2025-28857 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration rankchecker-io-integration allows Stored XSS.This issue affects Rankchecker.io Integration: from n/a through <= 1.0.9.
Product
Rankchecker.io Integration
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Rankchecker.io Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025W3Counter Free Real-Time Web Stats: Cross-Site Request Forgery (CSRF)CVE-2025-28856 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.This issue affects W3Counter Free Real-Time Web Stats: from n/a through <= 4.1.
Product
W3Counter Free Real-Time Web Stats
Affected
up to 4.1
What to do
Affects up to 4.1. Update W3Counter Free Real-Time Web Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Qubely – Advanced Gutenberg Blocks: Sensitive Information ExposureCVE-2024-13228 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data.
Product
Qubely – Advanced Gutenberg Blocks
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update Qubely – Advanced Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025Coronavirus (COVID-19) Notice Message: Does not sanitise and escape some of its settingsCVE-2025-0629 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Coronavirus (COVID-19) Notice Message
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Coronavirus (COVID-19) Notice Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025Countdown Timer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13864 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Countdown Timer
Affected
up to 1.0
What to do
Affects up to 1.0. Update Countdown Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13862 · WordPress plugins & themes · reported by WPScanHigh 7.1
The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality)
Affected
up to 8.0
What to do
Affects up to 8.0. Update S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025SEO Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13853 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
SEO Tools
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 11, 2025WP Login Control: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13836 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Login Control
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Login Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap: Does not sanitise and escape some of its settingsCVE-2024-13615 · WordPress plugins & themes · reported by WPScanLow 3.5
The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025XV Random Quotes: Does not have CSRF check in placeCVE-2024-13580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
Product
XV Random Quotes
Affected
up to 1.40
What to do
Affects up to 1.40. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025XV Random Quotes: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13574 · WordPress plugins & themes · reported by WPScanHigh 7.1
The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
XV Random Quotes
Affected
up to 1.40
What to do
Affects up to 1.40. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025ProductDyno: Reflected Cross-Site ScriptingCVE-2024-13413 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ProductDyno plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘res’ parameter in all versions up to, and including, 1.0.24 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is potentially a duplicate of CVE-2025-22320.
Product
ProductDyno
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update ProductDyno to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025The WPCS – WordPress Currency Switcher Professional: Arbitrary shortcode executionCVE-2025-2169 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The WPCS – WordPress Currency Switcher Professional
Affected
up to 1.2.0.4
What to do
Affects up to 1.2.0.4. Update The WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025HUSKY – Products Filter Professional for WooCommerce: Local File InclusionCVE-2025-1661 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.6.5
What to do
Affects up to 1.3.6.5. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025Appsero Helper: Cross-Site Request ForgeryCVE-2024-13436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Appsero Helper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'appsero_helper' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Appsero Helper
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Appsero Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2025Fresh Framework: Improper Control of Generation of Code ('Code Injection')CVE-2025-26936 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0.
Product
Fresh Framework
Affected
up to 1.70.0
What to do
Affects up to 1.70.0. Update Fresh Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 10, 2025WC Place Order Without Payment: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26933 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through <= 2.6.7.
Product
WC Place Order Without Payment
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update WC Place Order Without Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 10, 2025Massive Dynamic: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26916 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pixflow Massive Dynamic massive-dynamic.This issue affects Massive Dynamic: from n/a through <= 8.2.
Product
Massive Dynamic
Affected
up to 8.2
What to do
Affects up to 8.2. Update Massive Dynamic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 10, 2025WPBookit: Cross-Site Request Forgery (CSRF)CVE-2025-26910 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1.
Product
WPBookit
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 10, 2025Gtbabel: Does not ensure that the URL to perform code analysis upon belongs to the blogCVE-2024-11638 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.
Product
Gtbabel
Fixed in
6.6.9
What to do
Update Gtbabel to 6.6.9 or newer.
Full record and what to do →NVD record wpscan.com
Mar 10, 2025Page Builder: Pagelayer – Drag and Drop website builder: Cross-Site Request ForgeryCVE-2025-1926 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayer_save_post function. This makes it possible for unauthenticated attackers to modify post contents via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 9, 2025Contact Us By Lord Linus: Does not have CSRF check in some placesCVE-2025-1382 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Contact Us By Lord Linus
Affected
up to 2.6
What to do
Affects up to 2.6. Update Contact Us By Lord Linus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 9, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Does not sanitise and escape some of its settingsCVE-2025-1363 · WordPress plugins & themes · reported by WPScanLow 3.5
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
URL Shortener | Conversion Tracking | AB Testing | WooCommerce
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 9, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Does not have CSRF checks in some bulk actionsCVE-2025-1362 · WordPress plugins & themes · reported by WPScanMedium 4.3
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
Product
URL Shortener | Conversion Tracking | AB Testing | WooCommerce
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 8, 2025Starter Templates by FancyWP: Blind Server-Side Request ForgeryCVE-2024-13924 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'http_request_host_is_external' filter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Starter Templates by FancyWP
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Starter Templates by FancyWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025RomethemeKit For Elementor: Unauthorized modification of dataCVE-2024-10326 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options and reset_widgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or reset plugin widgets to their default state (all enabled). NOTE: This vulnerability was partially fixed in version 1.5.3.
Product
RomethemeKit For Elementor
Affected
up to 1.5.3
Fixed in
1.5.3
What to do
Update RomethemeKit For Elementor to 1.5.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2025-1664 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Parallax slider in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels): Stored Cross-Site ScriptingCVE-2024-13675 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Icon List" Block in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025140+ Widgets | Xpro Addons For Elementor – FREE: Stored Cross-Site ScriptingCVE-2024-13649 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.4.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
140+ Widgets | Xpro Addons For Elementor – FREE
Affected
up to 1.4.6.7
What to do
Affects up to 1.4.6.7. Update 140+ Widgets | Xpro Addons For Elementor – FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025VikRentCar Car Rental Management System: Cross-Site Request ForgeryCVE-2024-11640 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025Gallery Styles: Stored Cross-Site ScriptingCVE-2025-1783 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gallery Styles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery Block in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gallery Styles
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Gallery Styles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025WP-Recall – Registration, Profile, Commerce & More: Arbitrary shortcode executionCVE-2025-1325 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on the 'rcl_preview_post' AJAX endpoint in all versions up to, and including, 16.26.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.10
What to do
Affects up to 16.26.10. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025WP-Recall – Registration, Profile, Commerce & More: Stored Cross-Site ScriptingCVE-2025-1324 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'public-form' shortcode in all versions up to, and including, 16.26.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.10
What to do
Affects up to 16.26.10. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025WP-Recall – Registration, Profile, Commerce & More: SQL InjectionCVE-2025-1323 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.10
What to do
Affects up to 16.26.10. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025WP-Recall – Registration, Profile, Commerce & More: Information ExposureCVE-2025-1322 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to view data from password protected, private, or draft posts that they should not have access to.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.10
What to do
Affects up to 16.26.10. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025Product Input Fields for WooCommerce: Arbitrary file uploadsCVE-2024-13359 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that by default the plugin is only vulnerable to a double extension file upload attack, unless an administrators leaves the accepted file extensions field blank which can make .php file uploads possible. Please note 1.12.2 was mistakenly marked as patched while 1.12.1 was marked as vulnerable for a short period of time, this is not the case and 1.12.1 is fully patched.
Product
Product Input Fields for WooCommerce
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Stored Cross-Site ScriptingCVE-2025-1287 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown, Syntax Highlighter, and Page Scroll widgets in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 6.2.2
What to do
Affects up to 6.2.2. Update The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025Javo Core: Privilege escalationCVE-2025-0177 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
Product
Javo Core
Affected
up to 3.0.0.080
What to do
Affects up to 3.0.0.080. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 8, 2025Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit: Arbitrary file uploadsCVE-2024-13882 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all versions up to, and including, 2.3.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record coderevolution.ro wordfence.com
Mar 8, 2025Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit: Unauthorized access, modification, and loss of dataCVE-2024-13816 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete posts, list and delete batches, list assistant uploaded files, delete personas, delete forms, delete templates, and clear logs. The vulnerability was partially patched in version 2.3.5.
Product
Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record coderevolution.ro wordfence.com
Mar 8, 2025All-in-One Addons for Elementor – WidgetKit: Sensitive Information ExposureCVE-2024-10321 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 in elements/advanced-tab/template/view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
All-in-One Addons for Elementor – WidgetKit
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update All-in-One Addons for Elementor – WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025SMTP by BestWebSoft: Arbitrary file uploadsCVE-2024-13908 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
SMTP by BestWebSoft
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update SMTP by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon: Authentication bypassCVE-2024-11087 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
Product
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon
Affected
up to 200.3.9
What to do
Affects up to 200.3.9. Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record miniorange.com wordfence.com
Mar 8, 2025Post SMTP: Generic SQL InjectionCVE-2024-13844 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Post SMTP
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Mar 8, 2025Email Keep: Does not have CSRF check in placeCVE-2024-13826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Email Keep
Affected
up to 1.1
What to do
Affects up to 1.1. Update Email Keep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 8, 2025Email Keep: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13825 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Email Keep
Affected
up to 1.1
What to do
Affects up to 1.1. Update Email Keep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 8, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Stored Cross-Site ScriptingCVE-2024-12119 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the default_gallery_title_size parameter in all versions up to, and including, 2.4.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with granted gallery and album creator roles, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
Affected
up to 2.4.29
What to do
Affects up to 2.4.29. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 8, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Insecure Direct Object ReferenceCVE-2024-12114 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogallery_attachment_modal_save AJAX action due to missing validation on a user controlled key (img_id). This makes it possible for authenticated attackers, with granted access and above, to update arbitrary post and page content. This requires the Gallery Creator Role setting to be a value lower than 'Editor' for there to be any real impact.
Product
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
Affected
up to 2.4.29
What to do
Affects up to 2.4.29. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.