Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,587 results · page 417 of 832
Feb 26, 2025Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2024-13803 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-marker’ parameter in all versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlocalhostplugins.trac.wordpress.org
Feb 26, 2025R3W InstaFeed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13678 · WordPress plugins & themes · reported by WPScanMedium 6.1
The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- R3W InstaFeed
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update R3W InstaFeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025CalendApp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13669 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- CalendApp
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CalendApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025Post Sync: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13634 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Post Sync
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Post Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025Simple catalogue: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13633 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Simple catalogue
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Simple catalogue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025WP Extra Fields: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13632 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP Extra Fields
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025Om Stripe: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13631 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Om Stripe
- Affected
- up to 02.00.00
- What to do
- Affects up to 02.00.00. Update Om Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025NewsTicker: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13630 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- NewsTicker
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update NewsTicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025pushBIZ: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13629 · WordPress plugins & themes · reported by WPScanMedium 6.1
The pushBIZ WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- pushBIZ
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update pushBIZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025WP Pricing Table: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13628 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP Pricing Table
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025WPMovieLibrary: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13624 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WPMovieLibrary
- Affected
- up to 2.1.4.8
- What to do
- Affects up to 2.1.4.8. Update WPMovieLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025Post Timeline: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13571 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Post Timeline
- Fixed in
- 2.3.10
- What to do
- Update Post Timeline to 2.3.10 or newer.
Feb 26, 2025Subscriptions & Memberships for PayPal: Cross-Site Request ForgeryCVE-2024-13560 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Subscriptions & Memberships for PayPal
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Subscriptions & Memberships for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 26, 2025Countdown Timer for Elementor: Does not sanitise and escape some parametersCVE-2024-13113 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- Countdown Timer for Elementor
- Fixed in
- 1.3.7
- What to do
- Update Countdown Timer for Elementor to 1.3.7 or newer.
Feb 26, 2025Custom Block Builder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12878 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Custom Block Builder
- Fixed in
- 3.8.3
- What to do
- Update Custom Block Builder to 3.8.3 or newer.
Feb 26, 2025WP BASE Booking of Appointments, Services and Events: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12737 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP BASE Booking of Appointments, Services and Events
- Fixed in
- 5.0.0
- What to do
- Update WP BASE Booking of Appointments, Services and Events to 5.0.0 or newer.
Feb 26, 2025SureMembers: Sensitive Information ExposureCVE-2024-12434 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.6 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive data including restricted content.
- Product
- SureMembers
- Affected
- up to 1.10.6
- What to do
- Affects up to 1.10.6. Update SureMembers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsuremembers.comwordfence.com
Feb 26, 2025WooCommerce Cart Count Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10563 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WooCommerce Cart Count Shortcode
- Fixed in
- 1.1.0
- What to do
- Update WooCommerce Cart Count Shortcode to 1.1.0 or newer.
Feb 26, 2025Simple:Press Forum: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-10483 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- Simple:Press Forum
- Fixed in
- 6.10.11
- What to do
- Update Simple:Press Forum to 6.10.11 or newer.
Feb 26, 2025Simple Certain Time to Show Content: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-10152 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Simple Certain Time to Show Content
- Fixed in
- 1.3.1
- What to do
- Update Simple Certain Time to Show Content to 1.3.1 or newer.
Feb 25, 2025Simple Photo Feed: Missing AuthorizationCVE-2025-27000 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Photo Feed: from n/a through <= 1.4.0.
- Product
- Simple Photo Feed
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Simple Photo Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Market Exporter: Missing AuthorizationCVE-2025-26995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Anton Vanyukov Market Exporter market-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Market Exporter: from n/a through <= 2.0.21.
- Product
- Market Exporter
- Affected
- up to 2.0.21
- What to do
- Affects up to 2.0.21. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Atarim: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Reflected XSS.This issue affects Atarim: from n/a through <= 4.1.0.
- Product
- Atarim
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025WPPizza: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26991 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ollybach WPPizza wppizza allows Reflected XSS.This issue affects WPPizza: from n/a through <= 3.19.4.
- Product
- WPPizza
- Affected
- up to 3.19.4
- What to do
- Affects up to 3.19.4. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Frontend Admin by DynamiApps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26987 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Reflected XSS.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.25.17.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.25.17
- What to do
- Affects up to 3.25.17. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Majestic Support: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26985 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PHP Local File Inclusion.This issue affects Majestic Support: from n/a through <= 1.0.6.
- Product
- Majestic Support
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2025-26983 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.3.
- Product
- Recipe Card Blocks for Gutenberg & Elementor
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Recipe Card Blocks for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Web Accessibility By accessiBe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26981 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Reflected XSS.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.5.
- Product
- Web Accessibility By accessiBe
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Wired Impact Volunteer Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26980 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Stored XSS.This issue affects Wired Impact Volunteer Management: from n/a through <= 2.5.
- Product
- Wired Impact Volunteer Management
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Wired Impact Volunteer Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Funnel Builder by FunnelKit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26979 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.9.0.
- Product
- Funnel Builder by FunnelKit
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Funnel Builder by FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Filebird: Authorization Bypass Through User-Controlled KeyCVE-2025-26977 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through <= 6.4.2.1.
- Product
- Filebird
- Affected
- up to 6.4.2.1
- What to do
- Affects up to 6.4.2.1. Update Filebird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Strong Testimonials: Missing AuthorizationCVE-2025-26975 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Strong Testimonials: from n/a through <= 3.2.3.
- Product
- Strong Testimonials
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025WP Multistore Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26974 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Blind SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.1.
- Product
- WP Multistore Locator
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Poll Maker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26971 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Poll Maker poll-maker allows Blind SQL Injection.This issue affects Poll Maker: from n/a through <= 5.6.5.
- Product
- Poll Maker
- Affected
- up to 5.6.5
- What to do
- Affects up to 5.6.5. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025PrivateContent: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-26966 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.5.
- Product
- PrivateContent
- Affected
- up to 8.11.5
- What to do
- Affects up to 8.11.5. Update PrivateContent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Amelia: Authorization Bypass Through User-Controlled KeyCVE-2025-26965 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through <= 1.2.16.
- Product
- Amelia
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Eventin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26964 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.20.
- Product
- Eventin
- Affected
- up to 4.0.20
- What to do
- Affects up to 4.0.20. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025ClickWhale: Cross-Site Request Forgery (CSRF)CVE-2025-26963 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ClickWhale ClickWhale clickwhale allows Cross Site Request Forgery.This issue affects ClickWhale: from n/a through <= 2.4.3.
- Product
- ClickWhale
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Easy Contact Form Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26962 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Easy Contact Form Lite contact-form-lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through <= 1.1.25.
- Product
- Easy Contact Form Lite
- Affected
- up to 1.1.25
- What to do
- Affects up to 1.1.25. Update Easy Contact Form Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Small Package Quotes – Unishippers Edition: Missing AuthorizationCVE-2025-26960 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.9.
- Product
- Small Package Quotes – Unishippers Edition
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Affiliate Coupons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26957 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Deetronix Affiliate Coupons affiliate-coupons allows PHP Local File Inclusion.This issue affects Affiliate Coupons: from n/a through <= 1.7.3.
- Product
- Affiliate Coupons
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Affiliate Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Business Card Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Business Card Block business-card-block allows Stored XSS.This issue affects Business Card Block: from n/a through <= 1.0.5.
- Product
- Business Card Block
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Business Card Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Team Section Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26949 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XSS.This issue affects Team Section Block: from n/a through <= 1.0.9.
- Product
- Team Section Block
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Team Section Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Pie Register Premium: Missing AuthorizationCVE-2025-26948 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
- Product
- Pie Register Premium
- Affected
- up to 3.8.3.2
- What to do
- Affects up to 3.8.3.2. Update Pie Register Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Services Section block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26947 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows Stored XSS.This issue affects Services Section block: from n/a through <= 1.3.4.
- Product
- Services Section block
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Services Section block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025WP Yelp Review Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26946 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider wp-yelp-review-slider allows Blind SQL Injection.This issue affects WP Yelp Review Slider: from n/a through <= 8.1.
- Product
- WP Yelp Review Slider
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update WP Yelp Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Info Cards: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26945 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards info-cards allows Stored XSS.This issue affects Info Cards: from n/a through <= 1.0.5.
- Product
- Info Cards
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Info Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Easy Quotes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26943 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Blind SQL Injection.This issue affects Easy Quotes: from n/a through <= 1.2.2.
- Product
- Easy Quotes
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Easy Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Counters Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Counters Block counters-block allows Stored XSS.This issue affects Counters Block: from n/a through <= 1.1.2.
- Product
- Counters Block
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Counters Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Countdown Timer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer countdown-time allows Stored XSS.This issue affects Countdown Timer: from n/a through <= 1.2.6.
- Product
- Countdown Timer
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Countdown Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.