Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,555 results · page 42 of 112
Mar 6, 2026The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a loggedCVE-2026-3589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddeveloper.woocommerce.comwpscan.com
Mar 6, 2026PowerPack for LearnDash: Does not have authorization and CRSF checks in an AJAX actionCVE-2026-2446 · WordPress plugins & themes · reported by WPScanCritical 9.8
The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users
- Product
- PowerPack for LearnDash
- Fixed in
- 1.3.0
- What to do
- Update PowerPack for LearnDash to 1.3.0 or newer.
Mar 6, 2026WP eCommerce: Does not have CSRF check in placeCVE-2026-1128 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin remove them via a CSRF attack
- Product
- WP eCommerce
- Affected
- up to 3.15.1
- What to do
- Affects up to 3.15.1. Update WP eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Login with Salesforce: Does not validate that users are allowed to login through SalesforceCVE-2026-2418 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
- Product
- Login with Salesforce
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Login with Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 4, 2026Mail Mint: Does not have authorization in one of its REST API endpointCVE-2026-2025 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog
- Product
- Mail Mint
- Fixed in
- 1.19.5
- What to do
- Update Mail Mint to 1.19.5 or newer.
Feb 22, 2026Conditional CAPTCHA: Does not validate a parameter before redirecting the user to its valueCVE-2026-1369 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
- Product
- Conditional CAPTCHA
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Conditional CAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2026RegistrationMagic: Does not have proper capability checksCVE-2026-0929 · WordPress plugins & themes · reported by WPScanMedium 4.3
The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site.
- Product
- RegistrationMagic
- Fixed in
- 6.0.7.2
- What to do
- Update RegistrationMagic to 6.0.7.2 or newer.
Feb 7, 2026Post Slides: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-15491 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks
- Product
- Post Slides
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Post Slides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 2, 2026Five Star Restaurant Reservations: Does not have CSRF checks in some bulk actionsCVE-2026-0658 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting bookings via CSRF attacks.
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.7.9
- What to do
- Update Five Star Restaurant Reservations to 2.7.9 or newer.
Feb 2, 2026Library Viewer: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2025-15396 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Library Viewer
- Fixed in
- 3.2.0
- What to do
- Update Library Viewer to 3.2.0 or newer.
Feb 2, 2026User Profile Builder: Does not have a proper password reset processCVE-2025-15030 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
- Product
- User Profile Builder
- Fixed in
- 3.15.2
- What to do
- Update User Profile Builder to 3.15.2 or newer.
Jan 29, 2026Custom Login Page Customizer: Does not have a proper password reset processCVE-2025-14975 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
- Product
- Custom Login Page Customizer
- Fixed in
- 2.5.4
- What to do
- Update Custom Login Page Customizer to 2.5.4 or newer.
Jan 28, 2026User Activity Log: Does not properly handle failed login attempts in some casesCVE-2025-13471 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
- Product
- User Activity Log
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 26, 2026Recipe Card Blocks Lite: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-14973 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.
- Product
- Recipe Card Blocks Lite
- Fixed in
- 3.4.13
- What to do
- Update Recipe Card Blocks Lite to 3.4.13 or newer.
Jan 26, 2026AhaChat Messenger Marketing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14316 · WordPress plugins & themes · reported by WPScanHigh 7.1
The AhaChat Messenger Marketing WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- AhaChat Messenger Marketing
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AhaChat Messenger Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 12, 2026Quiz Maker: Does not sanitise and escape some of its settingsCVE-2025-14579 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Maker WordPress plugin before 6.7.0.89 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Quiz Maker
- Fixed in
- 6.7.0.89
- What to do
- Update Quiz Maker to 6.7.0.89 or newer.
Jan 9, 2026NEX-Forms: Does not sanitise and escape some of its settingsCVE-2025-14803 · WordPress plugins & themes · reported by WPScanMedium 6.8
The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.
- Product
- NEX-Forms
- Fixed in
- 9.1.8
- What to do
- Update NEX-Forms to 9.1.8 or newer.
Jan 5, 2026FlexTable: Does not sanitise and escape the imported links from Google Sheet cellsCVE-2025-9543 · WordPress plugins & themes · reported by WPScanLow 3.5
The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- FlexTable
- Fixed in
- 3.19.2
- What to do
- Update FlexTable to 3.19.2 or newer.
Jan 5, 2026Team: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-14124 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Team
- Fixed in
- 5.0.11
- What to do
- Update Team to 5.0.11 or newer.
Jan 2, 2026ShopBuilder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13456 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ShopBuilder
- Fixed in
- 3.2.2
- What to do
- Update ShopBuilder to 3.2.2 or newer.
Jan 2, 2026Logo Slider: Does not validate and escape some of its slider options before outputting them back in the dashboardCVE-2025-13153 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Logo Slider
- Fixed in
- 4.9.0
- What to do
- Update Logo Slider to 4.9.0 or newer.
Jan 1, 2026Comments: Does not properly validate user's identityCVE-2025-13820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.
- Product
- Comments
- Fixed in
- 7.6.40
- What to do
- Update Comments to 7.6.40 or newer.
Dec 31, 2025Knowband Mobile App Builder: Does not have authorisationCVE-2025-13029 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.
- Product
- Knowband Mobile App Builder
- Fixed in
- 3.0.0
- What to do
- Update Knowband Mobile App Builder to 3.0.0 or newer.
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14313 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14312 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025YaMaps for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-13958 · WordPress plugins & themes · reported by WPScanMedium 5.9
The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- YaMaps for
- Fixed in
- 0.6.40
- What to do
- Update YaMaps for to 0.6.40 or newer.
Dec 29, 2025Plugin Organizer: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-13417 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks.
- Product
- Plugin Organizer
- Fixed in
- 10.2.4
- What to do
- Update Plugin Organizer to 10.2.4 or newer.
Dec 24, 2025Gravity Forms: Does not properly prevent users from uploading dangerous files through its chunked upload functionalityCVE-2025-13407 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.
- Product
- Gravity Forms
- Fixed in
- 2.9.23.1
- What to do
- Update Gravity Forms to 2.9.23.1 or newer.
Dec 20, 2025Pure WC Variation Swatches: Does not have an authorization checkCVE-2025-12820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.
- Product
- Pure WC Variation Swatches
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Pure WC Variation Swatches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 15, 2025URL Shortify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13355 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- URL Shortify
- Fixed in
- 1.11.4
- What to do
- Update URL Shortify to 1.11.4 or newer.
Dec 15, 2025URL Shortify: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-12684 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins.
- Product
- URL Shortify
- Fixed in
- 1.11.3
- What to do
- Update URL Shortify to 1.11.3 or newer.
Dec 15, 2025Royal Addons for Elementor: Does not have proper authorisationCVE-2025-11363 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.
- Product
- Royal Addons for Elementor
- Fixed in
- 1.7.1037
- What to do
- Update Royal Addons for Elementor to 1.7.1037 or newer.
Dec 14, 2025HelloLeads CRM Form Shortcode: Does not have authorisation and CSRF checkCVE-2025-12696 · WordPress plugins & themes · reported by WPScanMedium 5.3
The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them
- Product
- HelloLeads CRM Form Shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update HelloLeads CRM Form Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2025WPS Visitor Counter: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-9116 · WordPress plugins & themes · reported by WPScanMedium 5.8
The WPS Visitor Counter WordPress plugin through 1.4.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- WPS Visitor Counter
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update WPS Visitor Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2025WooMulti: Does not validate a file parameterCVE-2025-12835 · WordPress plugins & themes · reported by WPScanHigh 7.3
The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber to delete arbitrary files on the server.
- Product
- WooMulti
- Affected
- up to 17
- What to do
- Affects up to 17. Update WooMulti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2025Construction Light: Does not have authorisation and CSRFCVE-2025-10684 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
- Product
- Construction Light
- Fixed in
- 1.6.8
- What to do
- Update Construction Light to 1.6.8 or newer.
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13073 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- HandL UTM Grabber / Tracker
- Fixed in
- 2.8.1
- What to do
- Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13072 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- HandL UTM Grabber / Tracker
- Fixed in
- 2.8.1
- What to do
- Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Dec 9, 2025Custom Admin Menu: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13071 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Custom Admin Menu
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Admin Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025CSV to SortTable: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-13070 · WordPress plugins & themes · reported by WPScanMedium 6.6
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
- Product
- CSV to SortTable
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update CSV to SortTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WPeMatico RSS Feed Fetcher: Does not sanitize and escape some of its settingsCVE-2025-13031 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.13
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.13 or newer.
Dec 3, 2025Timetable and Event Schedule by MotoPress: Does not verify a user has access to a specific eventCVE-2025-12954 · WordPress plugins & themes · reported by WPScanLow 2.7
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.
- Product
- Timetable and Event Schedule by MotoPress
- Fixed in
- 2.4.16
- What to do
- Update Timetable and Event Schedule by MotoPress to 2.4.16 or newer.
Dec 2, 2025donation: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-13001 · WordPress plugins & themes · reported by WPScanMedium 4.1
The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks
- Product
- donation
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2025db-access: Does not have authorization in an AJAX actionCVE-2025-13000 · WordPress plugins & themes · reported by WPScanHigh 7.7
The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQLI attacks
- Product
- db-access
- Affected
- up to 0.8.7
- What to do
- Affects up to 0.8.7. Update db-access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 26, 2025TAX SERVICE Electronic HDM: Does not authorization and CSRF checks in an AJAX actionCVE-2025-12061 · WordPress plugins & themes · reported by WPScanHigh 8.6
The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements
- Product
- TAX SERVICE Electronic HDM
- Fixed in
- 1.2.1
- What to do
- Update TAX SERVICE Electronic HDM to 1.2.1 or newer.
Nov 24, 2025The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing themCVE-2025-12628 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them
- What to do
- Update the plugin to the newest version.
Nov 24, 2025Broken Link Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-12629 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Broken Link Manager
- Affected
- up to 0.6.5
- What to do
- Affects up to 0.6.5. Update Broken Link Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2025Guest posting / Frontend Posting / Front Editor: Does not validate a parameter before redirecting the user to its valueCVE-2025-12569 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
- Product
- Guest posting / Frontend Posting / Front Editor
- Fixed in
- 5.0.0
- What to do
- Update Guest posting / Frontend Posting / Front Editor to 5.0.0 or newer.
Nov 24, 2025Backup Migration: Does not properly generate its backup path in certain server configurationsCVE-2025-12394 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.
- Product
- Backup Migration
- Fixed in
- 2.0.0
- What to do
- Update Backup Migration to 2.0.0 or newer.
Nov 24, 2025WordPress eCommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-14015 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WordPress eCommerce
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update WordPress eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.