Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

41,587 results · page 421 of 832

Feb 20, 2025Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Server-Side Request ForgeryCVE-2025-1043 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025LTL Freight Quotes – GlobalTranz Edition: Unauthorized modification of dataCVE-2025-1483 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the engtz_wd_save_dropship AJAX endpoint in all versions up to, and including, 2.3.12. This makes it possible for unauthenticated attackers to update the drop shipping settings.
Product
LTL Freight Quotes – GlobalTranz Edition
Affected
up to 2.3.12
What to do
Affects up to 2.3.12. Update LTL Freight Quotes – GlobalTranz Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025Typed JS: A typewriter style animation: Stored Cross-Site ScriptingCVE-2025-1328 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Typed JS: A typewriter style animation
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Typed JS: A typewriter style animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 20, 2025Legoeso PDF Manager: Time-based SQL InjectionCVE-2025-0866 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Legoeso PDF Manager
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Legoeso PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2025Content Blocks (Custom Post Widget): Stored Cross-Site ScriptingCVE-2024-6432 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's shortcode Content Block in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Content Blocks (Custom Post Widget)
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update Content Blocks (Custom Post Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2025Prime Addons for Elementor: Insecure Direct Object ReferenceCVE-2024-13855 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the pae_global_block shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract information from posts that are not public, including drafts, private, password protected, and restricted posts. This applies to posts created with Elementor only.
Product
Prime Addons for Elementor
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Prime Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 20, 2025Cookie Notice Bar: Stored Cross-Site ScriptingCVE-2024-13849 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Cookie Notice Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Cookie Notice Bar
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Cookie Notice Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 20, 2025Bandsintown Events: Stored Cross-Site ScriptingCVE-2024-13802 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintown_events' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bandsintown Events
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Bandsintown Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2025WooCommerce Food - Restaurant Menu & Food ordering: Arbitrary shortcode executionCVE-2024-13792 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
WooCommerce Food - Restaurant Menu & Food ordering
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update WooCommerce Food - Restaurant Menu & Food ordering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 20, 2025ravpage: PHP Object InjectionCVE-2024-13789 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via deserialization of untrusted input from the 'paramsv2' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
ravpage
Affected
up to 2.31
What to do
Affects up to 2.31. Update ravpage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2025Ultimate Classified Listings: Cross-Site Request ForgeryCVE-2024-13753 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the update_profile function. This makes it possible for unauthenticated attackers to modify victim's email via a forged request, which might lead to account takeover, granted they can trick a user into performing an action such as clicking on a link.
Product
Ultimate Classified Listings
Affected
up to 1.5
What to do
Affects up to 1.5. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2025Ultimate Classified Listings: Stored Cross-Site ScriptingCVE-2024-13748 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Ultimate Classified Listings
Affected
up to 1.4
What to do
Affects up to 1.4. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported): Unauthorized modification of data|loss of dataCVE-2024-13520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.9. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher.
Product
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
Affected
up to 4.4.9
What to do
Affects up to 4.4.9. Update Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025LTL Freight Quotes – GlobalTranz Edition: SQL InjectionCVE-2024-13476 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_dropship' AJAX endpoint in all versions up to, and including, 2.3.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LTL Freight Quotes – GlobalTranz Edition
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update LTL Freight Quotes – GlobalTranz Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025Login/Signup Popup ( Inline Form + Woocommerce ): Stored Cross-Site ScriptingCVE-2025-1064 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Login/Signup Popup ( Inline Form + Woocommerce )
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Login/Signup Popup ( Inline Form + Woocommerce ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025Modal Window – create popup modal window: Stored Cross-Site ScriptingCVE-2025-0897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 6.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Modal Window – create popup modal window
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update Modal Window – create popup modal window to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2025WPMobile.App: Open RedirectCVE-2024-13888 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
WPMobile.App
Affected
up to 11.56
What to do
Affects up to 11.56. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 20, 2025Unlimited Elements For Elementor: Stored Cross-Site ScriptingCVE-2024-13155 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all versions up to, and including, 1.5.140 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code base, to apply the patch, the affected widget: Transparent Split Hero must be deleted and reinstalled manually.
Product
Unlimited Elements For Elementor
Affected
up to 1.5.140
What to do
Affects up to 1.5.140. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record unlimited-elements.com wordpress.org
Feb 20, 2025Elementor Website Builder – More Than Just a Page Builder: Stored Cross-Site ScriptingCVE-2024-13445 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the border, margin and gap parameters in all versions up to, and including, 3.27.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Website Builder – More Than Just a Page Builder
Affected
up to 3.27.4
What to do
Affects up to 3.27.4. Update Elementor Website Builder – More Than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025ElementsKit Elementor addons: Sensitive Information ExposureCVE-2025-0968 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a missing capability checks on the get_megamenu_content() function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, trashed and private items.
Product
ElementsKit Elementor addons
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update ElementsKit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service: Stored Cross-Site ScriptingCVE-2025-0916 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 2.4.9 to 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: The vulnerability has been initially patched in version 2.4.8 and was reintroduced in version 2.4.9 with the removal of the wp_kses_post() built-in WordPress sanitization function.
Product
YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service
Affected
2.4.9 to 2.6.2
What to do
Affects 2.4.9 to 2.6.2. Update YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Small Package Quotes – Worldwide Express Edition: SQL InjectionCVE-2024-13534 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 5.2.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2025-27268 is likely a duplicate of this issue.
Product
Small Package Quotes – Worldwide Express Edition
Affected
up to 5.2.18
What to do
Affects up to 5.2.18. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Small Package Quotes – USPS Edition: SQL InjectionCVE-2024-13533 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Small Package Quotes – USPS Edition
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Small Package Quotes – USPS Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Small Package Quotes – For Customers of FedEx: SQL InjectionCVE-2024-13491 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 4.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Small Package Quotes – For Customers of FedEx
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update Small Package Quotes – For Customers of FedEx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025LTL Freight Quotes – ABF Freight Edition: SQL InjectionCVE-2024-13485 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 3.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LTL Freight Quotes – ABF Freight Edition
Affected
up to 3.3.7
What to do
Affects up to 3.3.7. Update LTL Freight Quotes – ABF Freight Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025LTL Freight Quotes – SAIA Edition: SQL InjectionCVE-2024-13483 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 2.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LTL Freight Quotes – SAIA Edition
Affected
up to 2.2.10
What to do
Affects up to 2.2.10. Update LTL Freight Quotes – SAIA Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025LTL Freight Quotes – R+L Carriers Edition: SQL InjectionCVE-2024-13481 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 3.3.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LTL Freight Quotes – R+L Carriers Edition
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update LTL Freight Quotes – R+L Carriers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025LTL Freight Quotes – SEFL Edition: SQL InjectionCVE-2024-13479 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 3.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LTL Freight Quotes – SEFL Edition
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update LTL Freight Quotes – SEFL Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025LTL Freight Quotes – TForce Edition: SQL InjectionCVE-2024-13478 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LTL Freight Quotes – TForce Edition
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update LTL Freight Quotes – TForce Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025LTL Freight Quotes – Old Dominion Edition: SQL InjectionCVE-2024-13489 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 4.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LTL Freight Quotes – Old Dominion Edition
Affected
up to 4.2.10
What to do
Affects up to 4.2.10. Update LTL Freight Quotes – Old Dominion Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Raptive Ads: Unauthorized accessCVE-2024-13364 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() and cls_file_reset() functions in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to reset the ad and cls files.
Product
Raptive Ads
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Raptive Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 19, 2025Raptive Ads: Reflected Cross-Site ScriptingCVE-2024-13363 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Raptive Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'poc' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Raptive Ads
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Raptive Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025DeBounce Email Validator: Cross-Site Request ForgeryCVE-2024-13339 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The DeBounce Email Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.8.0. This is due to missing or incorrect nonce validation on the 'debounce_email_validator' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
DeBounce Email Validator
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Disable Auto Updates: Cross-Site Request ForgeryCVE-2024-13336 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'disable-auto-updates' page. This makes it possible for unauthenticated attackers to disable all auto updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Disable Auto Updates
Affected
up to 1.4
What to do
Affects up to 1.4. Update Disable Auto Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025WordPress Portfolio Builder – Portfolio Gallery: Unauthorized modification of dataCVE-2024-13231 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_video' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to add arbitrary videos to any portfolio gallery.
Product
WordPress Portfolio Builder – Portfolio Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025WP Media Category Management: Cross-Site Request ForgeryCVE-2025-0865 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wp_mcm_handle_action_settings() function. This makes it possible for unauthenticated attackers to alter plugin settings, such as the taxonomy used for media, the base slug for media categories, and the default media category via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Media Category Management
Affected
2.0 to 2.3.3
What to do
Affects 2.0 to 2.3.3. Update WP Media Category Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Education Addon for Elementor: Insecure Direct Object ReferenceCVE-2024-13854 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naedu_elementor_template shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract information from posts that are not public, including drafts, password protected, and restricted posts. This applies to posts created with Elementor only.
Product
Education Addon for Elementor
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Education Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Pure Chat – Live Chat & More!: Stored Cross-Site ScriptingCVE-2024-13736 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pure Chat – Live Chat & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘purechatWidgetName’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pure Chat – Live Chat & More!
Affected
up to 2.4
What to do
Affects up to 2.4. Update Pure Chat – Live Chat & More! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025PeproDev Ultimate Invoice: Insecure Direct Object ReferenceCVE-2024-13719 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for completed orders which can contain PII of users.
Product
PeproDev Ultimate Invoice
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 19, 2025Pollin: SQL InjectionCVE-2024-13712 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Pollin
Affected
up to 1.01.1
What to do
Affects up to 1.01.1. Update Pollin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Pollin: Reflected Cross-Site ScriptingCVE-2024-13711 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Pollin
Affected
up to 1.01.1
What to do
Affects up to 1.01.1. Update Pollin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Widget BUY.BOX: Stored Cross-Site ScriptingCVE-2024-13679 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Widget BUY.BOX
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Widget BUY.BOX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Categorized Gallery: SQL InjectionCVE-2024-13676 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Categorized Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' attribute of the 'image_gallery' shortcode in all versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Categorized Gallery
Affected
up to 2.0
What to do
Affects up to 2.0. Update Categorized Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Cosmic Blocks (40+) Content Editor Blocks Collection: Stored Cross-Site ScriptingCVE-2024-13674 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cosmic Blocks (40+) Content Editor Blocks Collection plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cwp_social_share' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cosmic Blocks (40+) Content Editor Blocks Collection
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Cosmic Blocks (40+) Content Editor Blocks Collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Coaching Staffs: Stored Cross-Site ScriptingCVE-2024-13663 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Coaching Staffs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstw-cs-table' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Coaching Staffs
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Coaching Staffs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Responsive Flickr Slideshow: Stored Cross-Site ScriptingCVE-2024-13660 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Flickr Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fshow' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Flickr Slideshow
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Responsive Flickr Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Store Locator Widget: Stored Cross-Site ScriptingCVE-2024-13657 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'storelocatorwidget' shortcode in all versions up to, and including, 2025r1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Store Locator Widget
Affected
up to 2025r1
What to do
Affects up to 2025r1. Update Store Locator Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Team Builder For WPBakery Page Builder(Formerly Visual Composer): Local File InclusionCVE-2024-13592 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'team-builder-vc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
Affected
up to 1.0
What to do
Affects up to 1.0. Update Team Builder For WPBakery Page Builder(Formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Team Builder For WPBakery Page Builder(Formerly Visual Composer): Stored Cross-Site ScriptingCVE-2024-13591 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'team-builder-vc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
Affected
up to 1.0
What to do
Affects up to 1.0. Update Team Builder For WPBakery Page Builder(Formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025YouTube Playlists with Schema: Stored Cross-Site ScriptingCVE-2024-13589 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The YouTube Playlists with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yt_grid' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
YouTube Playlists with Schema
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update YouTube Playlists with Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.