Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

41,587 results · page 416 of 832

Feb 28, 2025WHMPress - WHMCS Client Area: Unauthorized modification of data that can lead to privilege escalationCVE-2024-9195 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the update_settings case in the /admin/ajax.php file in all versions up to, and including, 4.3-revision-3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WHMPress - WHMCS Client Area
Affected
up to 4.3-revision-3
What to do
Affects up to 4.3-revision-3. Update WHMPress - WHMCS Client Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 28, 2025WHMpress - WHMCS WordPress Integration: Local File InclusionCVE-2024-9193 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WHMpress - WHMCS WordPress Integration
Affected
up to 6.3-revision-0
What to do
Affects up to 6.3-revision-0. Update WHMpress - WHMCS WordPress Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record whmpress.com wordfence.com
Feb 28, 2025SecuPress Free — WordPress Security: Stored Cross-Site ScriptingCVE-2024-9019 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupress_check_ban_ips_form shortcode in all versions up to, and including, 2.2.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SecuPress Free — WordPress Security
Affected
up to 2.2.5.3
What to do
Affects up to 2.2.5.3. Update SecuPress Free — WordPress Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025WooCommerce Ultimate Gift Card: Arbitrary file uploadsCVE-2024-8425 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this may have been patched on an older version than 2.9.2, however, we do not have access to older versions of the software to confirm when the patch was added. The only patched version we have confirmed is 2.9.3.
Product
WooCommerce Ultimate Gift Card
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update WooCommerce Ultimate Gift Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 28, 2025DHVC Form: Privilege escalationCVE-2024-8420 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on sites.
Product
DHVC Form
Affected
up to 2.4.7
What to do
Affects up to 2.4.7. Update DHVC Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 28, 2025Modal Portfolio: Stored Cross-Site ScriptingCVE-2024-13851 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Modal Portfolio
Affected
up to 1.7.4.2
What to do
Affects up to 1.7.4.2. Update Modal Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 28, 2025Ultra Addons Lite for Elementor: Information ExposureCVE-2024-13832 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'ut_elementor' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Ultra Addons Lite for Elementor
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Ultra Addons Lite for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Tabs for WooCommerce: PHP Object InjectionCVE-2024-13831 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input in the 'product_has_custom_tabs' function. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Tabs for WooCommerce
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Tabs for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025Forex Calculators: Unauthorized modification of dataCVE-2024-13716 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_settings_callback() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
Forex Calculators
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Forex Calculators to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Order Attachments for WooCommerce: Sensitive Information ExposureCVE-2024-13638 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments added to orders.
Product
Order Attachments for WooCommerce
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Order Attachments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Pricing Table by PickPlugins: Stored Cross-Site ScriptingCVE-2024-13469 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1.12.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pricing Table by PickPlugins
Affected
up to 1.12.10
What to do
Affects up to 1.12.10. Update Pricing Table by PickPlugins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 28, 2025KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2025-1572 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and including, 3.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
KiviCare – Clinic & Patient Management System (EHR)
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Exclusive Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-1571 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Image Comparison Widgets in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Exclusive Addons for Elementor
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update Exclusive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 28, 2025Product Catalog Simple: Stored Cross-Site ScriptingCVE-2025-1405 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Product Catalog Simple
Affected
up to 1.7.11
What to do
Affects up to 1.7.11. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 28, 2025wpForo Forum: Arbitrary file readCVE-2025-0764 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to read arbitrary files on the server.
Product
wpForo Forum
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WorCVE-2025-1513 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Name and Comment field when commenting on photo gallery entries in all versions up to, and including, 26.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.0.0.1
What to do
Affects up to 26.0.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Reflected Cross-Site ScriptingCVE-2025-1511 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Wp Social Login and Register Social Counter: Cross-Site Request ForgeryCVE-2025-1506 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. This is due to missing or incorrect nonce validation on the counter_access_key_setup() function. This makes it possible for unauthenticated attackers to update social login provider settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Wp Social Login and Register Social Counter
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025MK Google Directions: Stored Cross-Site ScriptingCVE-2024-12820 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MK Google Directions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MKGD' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MK Google Directions
Affected
up to 3.1
What to do
Affects up to 3.1. Update MK Google Directions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025WordPress Portfolio Builder – Portfolio Gallery: Stored Cross-Site ScriptingCVE-2025-1757 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfhub_portfolio' and 'pfhub_portfolio_portfolio' shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Portfolio Builder – Portfolio Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Advanced AJAX Product Filters: Reflected Cross-Site ScriptingCVE-2025-1505 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Advanced AJAX Product Filters
Affected
up to 1.6.8.1
What to do
Affects up to 1.6.8.1. Update Advanced AJAX Product Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025RateMyAgent Official: Cross-Site Request ForgeryCVE-2025-0801 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RateMyAgent Official plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing or incorrect nonce validation on the 'rma-settings-wizard'. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RateMyAgent Official
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update RateMyAgent Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 28, 2025Post Grid and Gutenberg Blocks – ComboBlocks: Sensitive Information ExposureCVE-2024-13796 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.6 via the /wp-json/post-grid/v2/get_users REST API This makes it possible for unauthenticated attackers to extract sensitive data including including emails and other user data.
Product
Post Grid and Gutenberg Blocks – ComboBlocks
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Post Grid and Gutenberg Blocks – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025Cardealer: Cross-Site Request ForgeryCVE-2025-1687 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation on the 'update_user_profile' function. This makes it possible for unauthenticated attackers to update the user email and password via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Cardealer
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Cardealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net webtemplatemasters.com
Feb 27, 2025Cardealer: Privilege escalationCVE-2025-1682 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_settings' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the default user role.
Product
Cardealer
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Cardealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net webtemplatemasters.com
Feb 27, 2025Cardealer: Unauthorized modification of data and loss of dataCVE-2025-1681 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sanitization on the demo theme scheme AJAX functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to change or delete arbitrary css and js files.
Product
Cardealer
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Cardealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net webtemplatemasters.com
Feb 27, 2025Traveler: Local File InclusionCVE-2024-12811 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
Traveler
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record travelerwp.com wordfence.com
Feb 27, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable.CVE-2025-22624 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 5.1
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/extensions/albums/admin/class-meta boxes.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record fluidattacks.com wordpress.org
Feb 27, 2025WP Activity Log 5.3.2 was found to be vulnerable.CVE-2025-0767 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 6.3
WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php.
Affected
5.3.2 to 5.3.2
What to do
Affects 5.3.2 to 5.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record co.wordpress.org fluidattacks.com
Feb 27, 2025Woo Store Mode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23687 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simonhunter Woo Store Mode woo-store-mode allows Reflected XSS.This issue affects Woo Store Mode: from n/a through <= 1.0.1.
Product
Woo Store Mode
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Woo Store Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 27, 2025DefendWP Firewall: Missing AuthorizationCVE-2025-22280 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through <= 1.1.0.
Product
DefendWP Firewall
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update DefendWP Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 27, 2025Buddyboss Platform: Stored Cross-Site ScriptingCVE-2024-13402 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Buddyboss Platform
Affected
up to 2.7.70
What to do
Affects up to 2.7.70. Update Buddyboss Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record buddyboss.com wordfence.com
Feb 27, 2025Jeg Elementor Kit: Sensitive Information ExposureCVE-2024-13217 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expired_data' and 'build_content' functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
Product
Jeg Elementor Kit
Affected
up to 2.6.11
What to do
Affects up to 2.6.11. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerablCVE-2025-1450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-hover’ parameter in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025Card Elements for Elementor: Stored Cross-Site ScriptingCVE-2024-13734 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Card Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Profile Card widget in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Card Elements for Elementor
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Card Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 27, 2025ThemeMakers Stripe Checkout: Stored Cross-Site ScriptingCVE-2025-1690 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ThemeMakers Stripe Checkout
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update ThemeMakers Stripe Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com themeforest.net
Feb 27, 2025Car Dealer Automotive WordPress Theme – Responsive: Arbitrary file deletionCVE-2025-1282 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_post_photo() and add_car() functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The add_car() function may also make it possible to read arbitrary files.
Product
Car Dealer Automotive WordPress Theme – Responsive
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Car Dealer Automotive WordPress Theme – Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 27, 2025Login Me Now: Authentication bypassCVE-2025-1717 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own.
Product
Login Me Now
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Login Me Now to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025ThemeMakers PayPal Express Checkout: Stored Cross-Site ScriptingCVE-2025-1689 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ThemeMakers PayPal Express Checkout
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update ThemeMakers PayPal Express Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com themeforest.net
Feb 27, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Server-Side Request ForgeryCVE-2024-13907 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.16.8
What to do
Affects up to 1.16.8. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025Templines Elementor Helper Core: Privilege escalationCVE-2025-1295 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowing arbitrary user meta updates. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to Administrator. The vulnerability can only be exploited when the BuddyPress plugin is also installed and activated.
Product
Templines Elementor Helper Core
Affected
up to 2.7
What to do
Affects up to 2.7. Update Templines Elementor Helper Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost wordfence.com
Feb 27, 2025Image Photo Gallery Final Tiles Grid: Stored Cross-Site ScriptingCVE-2024-6261 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025Bricks: Privilege EscalationCVE-2024-2297 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation checks placed on the create_autosave AJAX function. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary PHP code with elevated (administrator-level) privileges. NOTE: Successful exploitation requires (1) the Bricks Builder to be enabled for posts (2) Builder access to be enabled for contributor-level users, and (3) "Code Execution" to be enabled for administrator-level users within the theme's settings.
Product
Bricks
Affected
up to 1.9.6.1
What to do
Affects up to 1.9.6.1. Update Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bricksbuilder.io wordfence.com
Feb 27, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-0469 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.39.2
What to do
Affects up to 1.39.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2025OneStore Sites: Server-Side Request ForgeryCVE-2024-13905 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
OneStore Sites
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update OneStore Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2025School Management System – SakolaWP: Cross-Site Request ForgeryCVE-2024-13647 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The School Management System – SakolaWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the 'save_exam_setting' and 'delete_exam_setting' actions. This makes it possible for unauthenticated attackers to update exam settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
School Management System – SakolaWP
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update School Management System – SakolaWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 26, 2025Events Manager: Missing AuthorizationCVE-2025-1249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through <= 6.6.4.1.
Product
Events Manager
Affected
up to 6.6.4.1
What to do
Affects up to 6.6.4.1. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2025Admin Menu Manager: Cross-Site Request Forgery (CSRF)CVE-2025-26925 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/a through 1.0.3.
Product
Admin Menu Manager
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Admin Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2025The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2025-1517 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 26, 2025Quiz Organizer: Stored Cross-Site ScriptingCVE-2024-6810 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Quiz Organizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Quiz Organizer
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Quiz Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.