Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

420new WordPress flaws this week

399,200entries in the database

41,601 results · page 442 of 833

Jan 22, 2025Instant Appointment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23672 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tenteeglobal Instant Appointment instant-appointment allows Reflected XSS.This issue affects Instant Appointment: from n/a through <= 1.2.
Product
Instant Appointment
Affected
up to 1.2
What to do
Affects up to 1.2. Update Instant Appointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025ReadMe Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23643 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in a.ankit ReadMe Creator readme-creator allows Reflected XSS.This issue affects ReadMe Creator: from n/a through <= 1.0.
Product
ReadMe Creator
Affected
up to 1.0
What to do
Affects up to 1.0. Update ReadMe Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Content Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Lewis Content Planner content-planner allows Reflected XSS.This issue affects Content Planner: from n/a through <= 1.0.
Product
Content Planner
Affected
up to 1.0
What to do
Affects up to 1.0. Update Content Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Cyber Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23630 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Irshad A.Khan Cyber Slider cyber-new-slider allows Reflected XSS.This issue affects Cyber Slider: from n/a through <= 1.1.
Product
Cyber Slider
Affected
up to 1.1
What to do
Affects up to 1.1. Update Cyber Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Unique UX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23625 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode Unique UX unique-ux allows Reflected XSS.This issue affects Unique UX: from n/a through <= 0.9.2.
Product
Unique UX
Affected
up to 0.9.2
What to do
Affects up to 0.9.2. Update Unique UX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WH Cache & Security: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webhue WH Cache & Security wh-cache-and-security allows Reflected XSS.This issue affects WH Cache & Security: from n/a through <= 1.1.2.
Product
WH Cache & Security
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WH Cache & Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Ultimate Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23610 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tehsmash Ultimate Events ultimate-events allows Reflected XSS.This issue affects Ultimate Events: from n/a through <= 1.3.3.
Product
Ultimate Events
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Ultimate Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Tagesteller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Helle1 Tagesteller tagesteller allows Reflected XSS.This issue affects Tagesteller: from n/a through <= v.1.1.
Product
Tagesteller
What to do
Update Tagesteller to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025CAMOO SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camoo Sarl CAMOO SMS camoo-sms allows Reflected XSS.This issue affects CAMOO SMS: from n/a through <= 3.0.1.
Product
CAMOO SMS
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update CAMOO SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Calendi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23606 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sebkay Calendi calendi allows Reflected XSS.This issue affects Calendi: from n/a through <= 1.1.1.
Product
Calendi
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Calendi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Call To Action Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lampd Call To Action Popup call-to-action-popup allows Reflected XSS.This issue affects Call To Action Popup: from n/a through <= 1.0.2.
Product
Call To Action Popup
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Call To Action Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Rezdy Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23604 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maeve Lander Rezdy Reloaded reloaded-rezdy allows Stored XSS.This issue affects Rezdy Reloaded: from n/a through <= 1.0.1.
Product
Rezdy Reloaded
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Rezdy Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Group category creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23603 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MohammadJafar Khajeh Group category creator group-category-creator allows Reflected XSS.This issue affects Group category creator: from n/a through <= 1.3.0.3.
Product
Group category creator
Affected
up to 1.3.0.3
What to do
Affects up to 1.3.0.3. Update Group category creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025EELV Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23602 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Reflected XSS.This issue affects EELV Newsletter: from n/a through <= 4.8.2.
Product
EELV Newsletter
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update EELV Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Tab My Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23601 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patrice Tab My Content tab-my-content allows Reflected XSS.This issue affects Tab My Content: from n/a through <= 1.0.0.
Product
Tab My Content
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Tab My Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Rio Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sabareesha Rio Photo Gallery rio-photo-gallery allows Reflected XSS.This issue affects Rio Photo Gallery: from n/a through <= 0.1.
Product
Rio Photo Gallery
Affected
up to 0.1
What to do
Affects up to 0.1. Update Rio Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025dForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23592 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in animexxx dForms dforms allows Reflected XSS.This issue affects dForms: from n/a through <= 1.0.
Product
dForms
Affected
up to 1.0
What to do
Affects up to 1.0. Update dForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025ContentOptin Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23589 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markugwuanyi ContentOptin Lite contentoptin allows Reflected XSS.This issue affects ContentOptin Lite: from n/a through <= 1.1.
Product
ContentOptin Lite
Affected
up to 1.1
What to do
Affects up to 1.1. Update ContentOptin Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Explara Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23583 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Explara Explara Membership explara-membership allows Reflected XSS.This issue affects Explara Membership: from n/a through <= 0.0.7.
Product
Explara Membership
Affected
up to 0.0.7
What to do
Affects up to 0.0.7. Update Explara Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Custom CSS Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Custom CSS Addons css-addons allows Reflected XSS.This issue affects Custom CSS Addons: from n/a through <= 1.9.1.
Product
Custom CSS Addons
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Custom CSS Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025XLSXviewer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-23562 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pitinca XLSXviewer xlsx-viewer allows Path Traversal.This issue affects XLSXviewer: from n/a through <= 2.1.1.
Product
XLSXviewer
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update XLSXviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Responsivity: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bilal TAS Responsivity responsivity allows Reflected XSS.This issue affects Responsivity: from n/a through <= 0.0.6.
Product
Responsivity
Affected
up to 0.0.6
What to do
Affects up to 0.0.6. Update Responsivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025REAL WordPress Sidebar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23535 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martin_ziegert REAL WordPress Sidebar drag-and-drop-custom-sidebar allows Stored XSS.This issue affects REAL WordPress Sidebar: from n/a through <= 0.1.
Product
REAL WordPress Sidebar
Affected
up to 0.1
What to do
Affects up to 0.1. Update REAL WordPress Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Team 118GROUP Agent: Missing AuthorizationCVE-2025-23512 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in 118group Team 118GROUP Agent team-118group-agent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team 118GROUP Agent: from n/a through <= 1.6.0.
Product
Team 118GROUP Agent
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Team 118GROUP Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025HyperComments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23509 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in siteheart HyperComments comments-with-hypercommentscom allows Reflected XSS.This issue affects HyperComments: from n/a through <= 0.9.6.
Product
HyperComments
Affected
up to 0.9.6
What to do
Affects up to 0.9.6. Update HyperComments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Blrt WP Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blrt Blrt WP Embed blrt-wp-embed allows Reflected XSS.This issue affects Blrt WP Embed: from n/a through <= 1.6.9.
Product
Blrt WP Embed
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Blrt WP Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WP IMAP Auth: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23506 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imsoftware WP IMAP Auth wp-imap-authentication allows Reflected XSS.This issue affects WP IMAP Auth: from n/a through <= 4.0.1.
Product
WP IMAP Auth
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP IMAP Auth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Customizable Captcha and Contact Us: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23503 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osolwordpress Customizable Captcha and Contact Us customizable-captcha-and-contact-us-form allows Reflected XSS.This issue affects Customizable Captcha and Contact Us: from n/a through <= 1.0.2.
Product
Customizable Captcha and Contact Us
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Customizable Captcha and Contact Us to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Simple Custom post type custom field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23500 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faaiq Simple Custom post type custom field simple-content-construction-kit allows Reflected XSS.This issue affects Simple Custom post type custom field: from n/a through <= 1.0.3.
Product
Simple Custom post type custom field
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Simple Custom post type custom field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Translation.Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23498 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ContentLocalized Translation.Pro translation-pro allows Reflected XSS.This issue affects Translation.Pro: from n/a through <= 1.0.0.
Product
Translation.Pro
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Translation.Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WooCommerce Order Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23495 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chetan Khandla WooCommerce Order Search woocommerce-order-searching allows Reflected XSS.This issue affects WooCommerce Order Search: from n/a through <= 1.1.0.
Product
WooCommerce Order Search
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WooCommerce Order Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Database Sync: Missing AuthorizationCVE-2025-23486 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tamlyn Database Sync database-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database Sync: from n/a through <= 0.5.1.
Product
Database Sync
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update Database Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025History timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23475 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fireantology History timeline history-timeline allows Reflected XSS.This issue affects History timeline: from n/a through <= 0.7.2.
Product
History timeline
Affected
up to 0.7.2
What to do
Affects up to 0.7.2. Update History timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025FWD Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23462 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anil Jailta FWD Slider fwd-slider allows Reflected XSS.This issue affects FWD Slider: from n/a through <= 1.0.
Product
FWD Slider
Affected
up to 1.0
What to do
Affects up to 1.0. Update FWD Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Simple shortcode buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23449 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidpuc Simple shortcode buttons simple-shortcode-buttons allows Reflected XSS.This issue affects Simple shortcode buttons: from n/a through <= 1.3.2.
Product
Simple shortcode buttons
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Simple shortcode buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Mapbox for WP Advanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22772 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stephanemartinw Mapbox for WP Advanced mapbox-for-wp-advanced allows Reflected XSS.This issue affects Mapbox for WP Advanced: from n/a through <= 1.0.0.
Product
Mapbox for WP Advanced
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Mapbox for WP Advanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Arbitrary shortcode executionCVE-2024-13499 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_do_shortcode() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Time-based SQL InjectionCVE-2024-13496 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was previously published as being fixed in version 7.2.2 which was incorrect. The correct fixed version is 7.3.2.
Product
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.3.1
Fixed in
7.2.2
What to do
Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to 7.2.2 or newer.
Full record and what to do →NVD record abrahack.com plugins.trac.wordpress.org
Jan 22, 2025The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Arbitrary shortcode executionCVE-2024-13495 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipress_ajax_get_logs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025WP Hotel Booking: Unauthorized access of dataCVE-2024-13447 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a list of registered user emails.
Product
WP Hotel Booking
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025AI Power: Complete AI Pack: PHP Object InjectionCVE-2025-0429 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_ai_forms() function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AI Power: Complete AI Pack: PHP Object InjectionCVE-2025-0428 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_prompts function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AI Power: Complete AI Pack: Unauthorized accessCVE-2024-13361 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_save_image_media function in all versions up to, and including, 1.8.96. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload image files and embed shortcode attributes in the image_alt value that will execute when sending a POST request to the attachment page.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AI Power: Complete AI Pack: Server-Side Request ForgeryCVE-2024-13360 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicg_troubleshoot_add_vector(). This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025Themify Builder: Reflected Cross-Site ScriptingCVE-2024-13319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Themify Builder
Affected
up to 7.6.5
What to do
Affects up to 7.6.5. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025XML for Google Merchant Center: Reflected Cross-Site ScriptingCVE-2024-13406 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
XML for Google Merchant Center
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update XML for Google Merchant Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AdForest: Authentication bypassCVE-2024-12857 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as any user as long as they have configured OTP login by phone number.
Product
AdForest
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 22, 2025Stackable – Page Builder Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2024-12117 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the Button block in all versions up to, and including, 3.13.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Stackable – Page Builder Gutenberg Blocks
Affected
up to 3.13.11
What to do
Affects up to 3.13.11. Update Stackable – Page Builder Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025WPBot Pro Wordpress Chatbot: Unauthorized modification of dataCVE-2024-12879 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qc_wp_latest_update_check_pro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create Simple Text Responses to chat queries.
Product
WPBot Pro Wordpress Chatbot
Affected
up to 13.5.5
What to do
Affects up to 13.5.5. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbot.pro
Jan 21, 2025Ketchup Shortcodes: Stored Cross-Site ScriptingCVE-2024-13590 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ketchup Shortcodes
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update Ketchup Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.