Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,555 results · page 44 of 112
Jun 30, 2025Contact Form: Does not sanitise and escape some of its settingsCVE-2025-5730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Contact Form
- Fixed in
- 1.1.29
- What to do
- Update Contact Form to 1.1.29 or newer.
Jun 30, 2025WP Lightbox 2: Does not correctly sanitize the value of the title attribute of links before using themCVE-2025-3745 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
- Product
- WP Lightbox 2
- Fixed in
- 3.0.6.8
- What to do
- Update WP Lightbox 2 to 3.0.6.8 or newer.
Jun 27, 2025WP Map Block: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-5194 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Map Block
- Fixed in
- 2.0.3
- What to do
- Update WP Map Block to 2.0.3 or newer.
Jun 27, 2025Firelight Lightbox: Does not sanitise and escape title attributes before outputting them in the pageCVE-2025-5035 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
- Product
- Firelight Lightbox
- Fixed in
- 2.3.16
- What to do
- Update Firelight Lightbox to 2.3.16 or newer.
Jun 21, 2025wp-file-download: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-5034 · WordPress plugins & themes · reported by WPScanHigh 7.1
The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- wp-file-download
- Fixed in
- 6.2.6
- What to do
- Update wp-file-download to 6.2.6 or newer.
Jun 17, 2025Ivory Search: Does not sanitise and escape some of its settingsCVE-2025-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Ivory Search
- Fixed in
- 5.5.10
- What to do
- Update Ivory Search to 5.5.10 or newer.
Jun 10, 2025Axle Demo Importer: Does not validate files to be uploadedCVE-2025-4954 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server
- Product
- Axle Demo Importer
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Axle Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2025inprosysmedia-likes-dislikes-post: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-4840 · WordPress plugins & themes · reported by WPScanHigh 7.5
The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- inprosysmedia-likes-dislikes-post
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update inprosysmedia-likes-dislikes-post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Broadstreet: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-4652 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Broadstreet
- Fixed in
- 1.51.8
- What to do
- Update Broadstreet to 1.51.8 or newer.
Jun 9, 2025Newsletter: Does not sanitise and escape some of its Form settingsCVE-2025-3582 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Newsletter
- Fixed in
- 8.85
- What to do
- Update Newsletter to 8.85 or newer.
Jun 9, 2025Newsletter: Does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embedCVE-2025-3581 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Newsletter
- Fixed in
- 8.8.5
- What to do
- Update Newsletter to 8.8.5 or newer.
Jun 6, 2025Short URL: Does not properly sanitise and escape a parameter before using it in SQL statementCVE-2023-2921 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.
- Product
- Short URL
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update Short URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2025File Provider: Does not have CSRF check in placeCVE-2025-4580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- File Provider
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update File Provider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2025File Provider: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-4578 · WordPress plugins & themes · reported by WPScanCritical 9.8
The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- File Provider
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update File Provider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 3, 2025Post Slider and Post Carousel with Post Vertical Scrolling Widget: Does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embedCVE-2025-4567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Post Slider and Post Carousel with Post Vertical Scrolling Widget
- Fixed in
- 3.2.10
- What to do
- Update Post Slider and Post Carousel with Post Vertical Scrolling Widget to 3.2.10 or newer.
Jun 3, 2025FancyBox for: Does not escape captions and titles attributes before using them to populate galleries' caption fieldsCVE-2025-3662 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS
- Product
- FancyBox for
- Fixed in
- 3.3.6
- What to do
- Update FancyBox for to 3.3.6 or newer.
Jun 3, 2025Newsletter: Does not sanitise and escape some of its Subscription settingsCVE-2025-3584 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Newsletter
- Fixed in
- 8.8.2
- What to do
- Update Newsletter to 8.8.2 or newer.
Jun 2, 2025WP-Optimize: Does not properly escape user inputCVE-2025-3951 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.
- Product
- WP-Optimize
- Fixed in
- 4.2.0
- What to do
- Update WP-Optimize to 4.2.0 or newer.
Jun 2, 2025Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro: Does not sanitise and escape some of its settingsCVE-2025-1485 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro
- Fixed in
- 5.1.6
- What to do
- Update Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro to 5.1.6 or newer.
May 30, 2025Gearside Developer Dashboard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-4429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Gearside Developer Dashboard
- Affected
- up to 1.0.72
- What to do
- Affects up to 1.0.72. Update Gearside Developer Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 22, 2025Blog2Social: Social Media Auto Post & Scheduler: Does not escape the title of postsCVE-2025-4133 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks.
- Product
- Blog2Social: Social Media Auto Post & Scheduler
- Fixed in
- 8.4.0
- What to do
- Update Blog2Social: Social Media Auto Post & Scheduler to 8.4.0 or newer.
May 21, 2025DIGITS: WordPress Mobile Number Signup and Login: Does not rate limit OTP validation attemptsCVE-2025-4094 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
- Product
- DIGITS: WordPress Mobile Number Signup and Login
- Fixed in
- 8.4.6.1
- What to do
- Update DIGITS: WordPress Mobile Number Signup and Login to 8.4.6.1 or newer.
May 20, 2025Order Delivery Date: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-2929 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Order Delivery Date
- Fixed in
- 12.4.0
- What to do
- Update Order Delivery Date to 12.4.0 or newer.
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2561 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ninja Forms
- Fixed in
- 3.10.1
- What to do
- Update Ninja Forms to 3.10.1 or newer.
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2560 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ninja Forms
- Fixed in
- 3.10.1
- What to do
- Update Ninja Forms to 3.10.1 or newer.
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2524 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ninja Forms
- Fixed in
- 3.10.1
- What to do
- Update Ninja Forms to 3.10.1 or newer.
May 19, 2025Qi Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-1627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qi Blocks
- Fixed in
- 1.4
- What to do
- Update Qi Blocks to 1.4 or newer.
May 19, 2025Qi Blocks: Does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embedCVE-2025-1626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qi Blocks
- Fixed in
- 1.4
- What to do
- Update Qi Blocks to 1.4 or newer.
May 19, 2025Qi Blocks: Does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embedCVE-2025-1625 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qi Blocks
- Fixed in
- 1.4
- What to do
- Update Qi Blocks to 1.4 or newer.
May 17, 2025CSV Mass Importer: Does not properly validate uploaded filesCVE-2025-4190 · WordPress plugins & themes · reported by WPScanHigh 7.2
The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- CSV Mass Importer
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update CSV Mass Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Simple Lightbox: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3516 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Simple Lightbox
- Fixed in
- 2.9.4
- What to do
- Update Simple Lightbox to 2.9.4 or newer.
May 16, 2025Contact Form builder with drag & drop for WordPress: Does not sanitise and escape some of its settingsCVE-2025-3201 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
- Product
- Contact Form builder with drag & drop for WordPress
- Fixed in
- 2.4.3
- What to do
- Update Contact Form builder with drag & drop for WordPress to 2.4.3 or newer.
May 15, 2025WP-PManager: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2248 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- WP-PManager
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP-PManager: Does not have CSRF check in placeCVE-2025-2247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP-PManager
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025FunnelKit: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- FunnelKit
- Fixed in
- 3.10.2
- What to do
- Update FunnelKit to 3.10.2 or newer.
May 15, 2025Ninja Pages: Does not sanitise and escape some of its settingsCVE-2025-1454 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ninja Pages
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Ninja Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Plugin Oficial: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1303 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- Plugin Oficial
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Plugin Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Plugin Oficial: Does not sanitise and escape some of its settingsCVE-2025-1289 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Plugin Oficial
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Plugin Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WOOEXIM: Does not have CSRF check in some placesCVE-2025-1288 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack.
- Product
- WOOEXIM
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Download HTML TinyMCE Button: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1286 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Download HTML TinyMCE Button
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Download HTML TinyMCE Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Badgearoo: Does not sanitise and escape some of its settingsCVE-2025-1033 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Badgearoo
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Badgearoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0688 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- Spiritual Gifts Survey (and optional S.H.A.P.E survey)
- Affected
- up to 0.9.10
- What to do
- Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0687 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- Spiritual Gifts Survey (and optional S.H.A.P.E survey)
- Affected
- up to 0.9.10
- What to do
- Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025AI ChatBot for WordPress: Does not sanitise and escape some of its settingsCVE-2025-0329 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AI ChatBot for WordPress
- Fixed in
- 6.2.4
- What to do
- Update AI ChatBot for WordPress to 6.2.4 or newer.
May 15, 2025Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses: Does not sanitise and escape some of its settingsCVE-2024-9882 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses
- Fixed in
- 1.9.4
- What to do
- Update Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses to 1.9.4 or newer.
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9879 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Melapress File Monitor
- Fixed in
- 2.1.1
- What to do
- Update Melapress File Monitor to 2.1.1 or newer.
May 15, 2025Auto Affiliate Links: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Auto Affiliate Links
- Fixed in
- 6.4.7
- What to do
- Update Auto Affiliate Links to 6.4.7 or newer.
May 15, 2025Taskbuilder: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9831 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Taskbuilder
- Fixed in
- 3.0.9
- What to do
- Update Taskbuilder to 3.0.9 or newer.
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9711 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- EKC Tournament Manager
- Fixed in
- 2.2.2
- What to do
- Update EKC Tournament Manager to 2.2.2 or newer.
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9709 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- EKC Tournament Manager
- Fixed in
- 2.2.2
- What to do
- Update EKC Tournament Manager to 2.2.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.