Updated 20 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

591 results · page 5 of 12

Jun 15, 2026Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.CVE-2026-24637 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.
Affected
up to 11.15.10
What to do
Affects up to 11.15.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Broken Access Control in Bookify <= 1.1.1 versions.CVE-2025-69332 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Bookify <= 1.1.1 versions.
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.CVE-2025-68840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar setCVE-2016-20084 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jun 15, 2026BBS e-Franchise 1.1.1: SQL injectionCVE-2016-20072 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.
Product
BBS e-Franchise 1.1.1
What to do
Update BBS e-Franchise 1.1.1 to the newest version.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Jun 10, 2026Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page.CVE-2026-53737 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.
Affected
up to 1.12.18
What to do
Affects up to 1.12.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org vulncheck.com
Jun 4, 2026WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts thCVE-2019-25742 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execute when administrators view the property for approval, enabling cookie theft and session hijacking.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record fruitfulcode.com themeforest.net
Jun 4, 2026Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to includCVE-2019-25734 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record web-dorado.com wordpress.org
May 23, 2026WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through theCVE-2018-25347 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 23, 2026WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injectCVE-2018-25346 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com vulncheck.com
May 18, 2026Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer: Are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used durCVE-2026-3220 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
Product
Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer
Fixed in
3.1.15
What to do
Update Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer to 3.1.15 or newer.
Full record and what to do →NVD record wpscan.com
May 16, 2026WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldCVE-2021-47975 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldtitle` parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wplearnmanager.com
May 16, 2026the Brand component that: WordPress Theme Wibar 1.1.8 contains a stored cross-site scriptingCVE-2020-37235 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.
Product
the Brand component that
What to do
Update the Brand component that to the newest version.
Full record and what to do →NVD record demo.themeftc.com themeforest.net
May 10, 2026WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts bCVE-2021-47927 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting insufficient sanitization of the forum name parameter. Attackers can submit POST requests to the admin setup page with JavaScript payloads in the wps_admin_forum_add_name parameter, which are stored and executed when the forum is accessed.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpsymposiumpro.com wordpress.org
Jan 16, 2026the bundled plupload example endpoint: Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file uploadCVE-2012-10064 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without enforcing safe file type restrictions, enabling an attacker to place attacker-controlled files under the plugin's uploads directory. This can lead to remote code execution if a server-executable file type is uploaded and subsequently accessed.
Product
the bundled plupload example endpoint
What to do
Update the bundled plupload example endpoint to the newest version.
Full record and what to do →NVD record packetstorm.news web.archive.org
Dec 29, 2025Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery)CVE-2023-32238 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1.
Fixed in
5.8.1.1
What to do
Update the plugin to 5.8.1.1 or newer.
Full record and what to do →NVD record vdp.patchstack.com
Jul 24, 2025Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to inCVE-2025-8071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2025The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter.CVE-2025-5920 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API.
Fixed in
1.1.1
What to do
Update the plugin to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versionCVE-2024-5647 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 15, 2025Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12734 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2025PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable.CVE-2025-0769 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 6.3
PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record co.wordpress.org fluidattacks.com
Jan 28, 2025The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13CVE-2024-13509 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability is partially fixed in 1.10.13 and completely fixed in 1.10.14.
Affected
up to 1.10.13
Fixed in
1.10.13
What to do
Update the plugin to 1.10.13 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 14, 2024The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.CVE-2024-10924 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
Affected
9.0.0 to 9.1.1.1
What to do
Affects 9.0.0 to 9.1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to mCVE-2016-15042 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wpscan.com
Jun 7, 2024Music Store - WordPress eCommerce versions prior to 1.1.14: SQL injectionCVE-2024-36082 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands. Information stored in the database may be obtained or altered by the attacker.
Product
Music Store - WordPress eCommerce versions prior to 1.1.14
Fixed in
1.1.14
What to do
Update Music Store - WordPress eCommerce versions prior to 1.1.14 to 1.1.14 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
May 8, 2024Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability.CVE-2024-32674 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.
Fixed in
1.1.32
What to do
Update the plugin to 1.1.32 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 23, 2024Forminator prior to 1.15.4 contains a cross-site scripting vulnerability.CVE-2024-31857 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser.
Fixed in
1.15.4
What to do
Update the plugin to 1.15.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 16, 2024Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (suchCVE-2022-1538 · WordPress plugins & themes · reported by WPScanHigh 7.2
Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed.
Fixed in
1.1.1
What to do
Update the plugin to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tagsCVE-2023-5845 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tags
Product
Simple Social Media Share Buttons
Fixed in
5.1.1
What to do
Update Simple Social Media Share Buttons to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versioCVE-2023-47834 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.
Affected
up to 8.1.13
What to do
Affects up to 8.1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.CVE-2023-40002 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter plugin <= 1.17 versions.CVE-2023-47768 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter plugin <= 1.17 versions.
Affected
up to 1.17
What to do
Affects up to 1.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versCVE-2023-47766 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versions.
Fixed in
1.11.1
What to do
Update the plugin to 1.11.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions.CVE-2023-47819 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions.CVE-2023-47792 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions.
Fixed in
2.1.2
What to do
Update the plugin to 2.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.CVE-2023-47791 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Autolinks Manager plugin <= 1.10.04 versions.CVE-2023-46625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Autolinks Manager plugin <= 1.10.04 versions.
Affected
up to 1.10.04
What to do
Affects up to 1.10.04. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.CVE-2023-28618 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.
Affected
up to 1.16
What to do
Affects up to 1.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.CVE-2023-29428 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme <= 7.1.1 versions.CVE-2023-32500 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme <= 7.1.1 versions.
Fixed in
7.1.2
What to do
Update the plugin to 7.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions.CVE-2023-34177 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions.
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.CVE-2023-46777 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Djo Original texts Yandex WebMaster plugin <= 1.18 versions.CVE-2023-46775 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Djo Original texts Yandex WebMaster plugin <= 1.18 versions.
Affected
up to 1.18
What to do
Affects up to 1.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 29, 2023A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress.CVE-2005-10002 · WordPress plugins & themes · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.
Product
almosteffortless secure-files
Affected
up to 1.1
What to do
Affects up to 1.1. Update almosteffortless secure-files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Novo-media Novo-Map : your WP posts on custom google maps plugin <= 1.1.2 versions.CVE-2023-46190 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Novo-media Novo-Map : your WP posts on custom google maps plugin <= 1.1.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole Smooth Scroll Links [SSL] plugin <= 1.1.0 versions.CVE-2023-46095 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole Smooth Scroll Links [SSL] plugin <= 1.1.0 versions.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 16, 2023A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress.CVE-2011-10004 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown processing of the file uploadImage.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The identifier of the patch is e3ff616dc08d3aadff9253f1085e13f677d0c676. It is recommended to upgrade the affected component. The identifier VDB-242189 was assigned to this vulnerability.
Product
reciply
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update reciply to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.CVE-2023-45654 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in ZAKSTAN WhitePage plugin <= 1.1.5 versions.CVE-2023-45109 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ZAKSTAN WhitePage plugin <= 1.1.5 versions.
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mailrelay plugin <= 2.1.1 versions.CVE-2023-45108 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mailrelay plugin <= 2.1.1 versions.
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.