Updated 8 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

557new WordPress flaws this week

391,528entries in the database

4,612 results · page 57 of 93

Mar 3, 2025All push notification for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25092 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through <= 1.5.3.
Product
All push notification for WP
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update All push notification for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025CM Map Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24758 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.0.8.
Product
CM Map Locations
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update CM Map Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Notifications Center: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23741 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Florian Chaillou Notifications Center notifications-center allows Reflected XSS.This issue affects Notifications Center: from n/a through <= 1.5.2.
Product
Notifications Center
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Notifications Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Catch Duplicate Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23619 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Catch Duplicate Switcher catch-duplicate-switcher allows Reflected XSS.This issue affects Catch Duplicate Switcher: from n/a through <= 2.0.
Product
Catch Duplicate Switcher
Affected
up to 2.0
What to do
Affects up to 2.0. Update Catch Duplicate Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP Post Category Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23586 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MAL73049 WP Post Category Notifications wp-post-category-notifications allows Reflected XSS.This issue affects WP Post Category Notifications: from n/a through <= 1.0.
Product
WP Post Category Notifications
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Post Category Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Pin Locations on Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23584 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arsh91 Pin Locations on Map pin-locations-on-map allows Reflected XSS.This issue affects Pin Locations on Map: from n/a through <= 1.0.
Product
Pin Locations on Map
Affected
up to 1.0
What to do
Affects up to 1.0. Update Pin Locations on Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Push Envoy Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netbitsolutions Push Envoy Notifications push-envoy allows Reflected XSS.This issue affects Push Envoy Notifications: from n/a through <= 1.0.0.
Product
Push Envoy Notifications
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Push Envoy Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025G Web Pro Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23519 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jas Saran G Web Pro Store Locator gwebpro-store-locator allows Reflected XSS.This issue affects G Web Pro Store Locator: from n/a through <= 2.0.1.
Product
G Web Pro Store Locator
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update G Web Pro Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 1, 2025Alloggio Membership: Authentication BypassCVE-2025-1638 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity through the alloggio_membership_init_rest_api_facebook_login and alloggio_membership_init_rest_api_google_login functions. This makes it possible for unauthenticated attackers to log in as any user, including administrators, without knowing a password.
Product
Alloggio Membership
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Alloggio Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 1, 2025IP2Location Redirection: Unauthorized access of dataCVE-2025-1502 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_redirection_backup' AJAX action in all versions up to, and including, 1.33.3. This makes it possible for unauthenticated attackers to download the plugin's settings.
Product
IP2Location Redirection
Affected
up to 1.33.3
What to do
Affects up to 1.33.3. Update IP2Location Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 1, 2025Booking Calendar and Notification: Unauthorized access, modification, and loss of dataCVE-2024-13746 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on the wpcb_all_bookings(), wpcb_update_booking_post(), and wpcb_delete_posts() functions in all versions up to, and including, 4.0.3. This makes it possible for unauthenticated attackers to extract data, create or update bookings, or delete arbitrary posts.
Product
Booking Calendar and Notification
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Booking Calendar and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025WHMPress - WHMCS Client Area: Unauthorized modification of data that can lead to privilege escalationCVE-2024-9195 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the update_settings case in the /admin/ajax.php file in all versions up to, and including, 4.3-revision-3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WHMPress - WHMCS Client Area
Affected
up to 4.3-revision-3
What to do
Affects up to 4.3-revision-3. Update WHMPress - WHMCS Client Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 28, 2025Forex Calculators: Unauthorized modification of dataCVE-2024-13716 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_settings_callback() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
Forex Calculators
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Forex Calculators to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Product Catalog Simple: Stored Cross-Site ScriptingCVE-2025-1405 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Product Catalog Simple
Affected
up to 1.7.11
What to do
Affects up to 1.7.11. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 27, 2025Cardealer: Unauthorized modification of data and loss of dataCVE-2025-1681 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sanitization on the demo theme scheme AJAX functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to change or delete arbitrary css and js files.
Product
Cardealer
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Cardealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net webtemplatemasters.com
Feb 27, 2025Login Me Now: Authentication bypassCVE-2025-1717 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own.
Product
Login Me Now
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Login Me Now to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 26, 2025Simple catalogue: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13633 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Simple catalogue
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Simple catalogue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 25, 2025WP Multistore Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26974 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Blind SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.1.
Product
WP Multistore Locator
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025PrivateContent: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-26966 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.5.
Product
PrivateContent
Affected
up to 8.11.5
What to do
Affects up to 8.11.5. Update PrivateContent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 22, 2025IP2Location Country Blocker: Regular Information ExposureCVE-2025-1361 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings.
Product
IP2Location Country Blocker
Affected
up to 2.38.8
What to do
Affects up to 2.38.8. Update IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2025Newpost Catch: Stored Cross-Site ScriptingCVE-2025-1406 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, and including, 1.3.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Newpost Catch
Affected
up to 1.3.19
What to do
Affects up to 1.3.19. Update Newpost Catch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 20, 2025LTL Freight Quotes – GlobalTranz Edition: Unauthorized modification of dataCVE-2025-1483 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the engtz_wd_save_dropship AJAX endpoint in all versions up to, and including, 2.3.12. This makes it possible for unauthenticated attackers to update the drop shipping settings.
Product
LTL Freight Quotes – GlobalTranz Edition
Affected
up to 2.3.12
What to do
Affects up to 2.3.12. Update LTL Freight Quotes – GlobalTranz Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported): Unauthorized modification of data|loss of dataCVE-2024-13520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.9. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher.
Product
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
Affected
up to 4.4.9
What to do
Affects up to 4.4.9. Update Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025WordPress Portfolio Builder – Portfolio Gallery: Unauthorized modification of dataCVE-2024-13231 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_video' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to add arbitrary videos to any portfolio gallery.
Product
WordPress Portfolio Builder – Portfolio Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025WP Media Category Management: Cross-Site Request ForgeryCVE-2025-0865 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wp_mcm_handle_action_settings() function. This makes it possible for unauthenticated attackers to alter plugin settings, such as the taxonomy used for media, the base slug for media categories, and the default media category via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Media Category Management
Affected
2.0 to 2.3.3
What to do
Affects 2.0 to 2.3.3. Update WP Media Category Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Education Addon for Elementor: Insecure Direct Object ReferenceCVE-2024-13854 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naedu_elementor_template shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract information from posts that are not public, including drafts, password protected, and restricted posts. This applies to posts created with Elementor only.
Product
Education Addon for Elementor
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Education Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Categorized Gallery: SQL InjectionCVE-2024-13676 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Categorized Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' attribute of the 'image_gallery' shortcode in all versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Categorized Gallery
Affected
up to 2.0
What to do
Affects up to 2.0. Update Categorized Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Store Locator Widget: Stored Cross-Site ScriptingCVE-2024-13657 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'storelocatorwidget' shortcode in all versions up to, and including, 2025r1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Store Locator Widget
Affected
up to 2025r1
What to do
Affects up to 2025r1. Update Store Locator Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Trash Duplicate and 301 Redirect: Unauthorized loss of dataCVE-2024-13468 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-action-top' action in all versions up to, and including, 1.9. This makes it possible for unauthenticated attackers to delete arbitrary posts/pages.
Product
Trash Duplicate and 301 Redirect
Affected
up to 1.9
What to do
Affects up to 1.9. Update Trash Duplicate and 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 19, 2025Lexicata: Reflected Cross-Site ScriptingCVE-2024-12069 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Lexicata plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link.
Product
Lexicata
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update Lexicata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 18, 2025Age Verification for your checkout page.CVE-2025-22622 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 4.3
Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/class-wc-integration-agechecker-integration.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record fluidattacks.com wordpress.org
Feb 18, 2025Real Estate Manager: Improper Restriction of Excessive Authentication AttemptsCVE-2025-22645 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Password Brute Forcing.This issue affects Real Estate Manager: from n/a through <= 7.3.
Product
Real Estate Manager
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Team Builder – Meet the Team: Unauthorized modification of dataCVE-2024-13687 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_team_builder_options() function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
Team Builder – Meet the Team
Affected
up to 1.3
What to do
Affects up to 1.3. Update Team Builder – Meet the Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025CATS Job Listings: Stored Cross-Site ScriptingCVE-2024-13577 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CATS Job Listings
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update CATS Job Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025WooODT Lite – Delivery & pickup date time location for WooCommerce: Full Path DisclosureCVE-2024-13540 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodt_get_all_orders.php file being publicly accessible and generating a publicly visible error message. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
WooODT Lite – Delivery & pickup date time location for WooCommerce
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WooODT Lite – Delivery & pickup date time location for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 17, 2025Coder: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-13726 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Coder
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Coder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 15, 2025Customer Email Verification for WooCommerce: Sensitive Information ExposureCVE-2024-13525 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via Shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including emails as well as hashed passwords of any user.
Product
Customer Email Verification for WooCommerce
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update Customer Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2025Analytics Cat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24615 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Analytics Cat analytics-cat allows Reflected XSS.This issue affects Analytics Cat: from n/a through <= 1.1.2.
Product
Analytics Cat
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Analytics Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Push Notification for Post and BuddyPress: Missing AuthorizationCVE-2025-23771 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through <= 2.11.
Product
Push Notification for Post and BuddyPress
Affected
up to 2.11
What to do
Affects up to 2.11. Update Push Notification for Post and BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Naver Syndication V2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26552 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in badrHan Naver Syndication V2 badr-naver-syndication allows Stored XSS.This issue affects Naver Syndication V2: from n/a through <= 0.8.3.
Product
Naver Syndication V2
Affected
up to 0.8.3
What to do
Affects up to 0.8.3. Update Naver Syndication V2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025WP Directorybox Manager: Authentication BypassCVE-2024-13182 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator.
Product
WP Directorybox Manager
Affected
up to 2.5
What to do
Affects up to 2.5. Update WP Directorybox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost wordfence.com
Feb 13, 2025Read More & Accordion: Unauthorized modification and loss of dataCVE-2024-13639 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteData() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary 'read more' posts.
Product
Read More & Accordion
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update Read More & Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 12, 2025Customer Email Verification for WooCommerce: Authentication BypassCVE-2024-13528 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.9.5. This is due to the presence of a shortcode that will generate a confirmation link with a placeholder email. This makes it possible for authenticated attackers, with Contributor-level access and above, to generate a verification link for any unverified user and log into the account. The 'Fine tune placement' option must be enabled in the plugin settings in order to exploit the vulnerability.
Product
Customer Email Verification for WooCommerce
Affected
up to 2.9.5
What to do
Affects up to 2.9.5. Update Customer Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 12, 2025Apus Framework: Unauthorized modification of data that can lead to privilege escalationCVE-2024-12296 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Apus Framework plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'import_page_options' function in all versions up to, and including, 2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. NOTE: This vulnerability was partially fixed in version 2.4.
Product
Apus Framework
Affected
up to 2.4
Fixed in
2.4
What to do
Update Apus Framework to 2.4 or newer.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 12, 2025WP Booking Calendar: Unauthenticated Post-Confirmation Booking ManipulationCVE-2024-13821 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This makes it possible for unauthenticated attackers to manipulate their confirmed bookings, even after they have been approved.
Product
WP Booking Calendar
Affected
up to 10.10
What to do
Affects up to 10.10. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2025ConvertPlus: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13800 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cp_dismiss_notice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to '1' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Product
ConvertPlus
Affected
up to 3.5.30
What to do
Affects up to 3.5.30. Update ConvertPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record convertplug.com wordfence.com
Feb 12, 2025Click Mag - Viral WordPress News Magazine/Blog: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13656 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including, 3.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
Click Mag - Viral WordPress News Magazine/Blog
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Click Mag - Viral WordPress News Magazine/Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 12, 2025ZoxPress - The All-In-One WordPress News: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13654 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'reset_options' function in all versions up to, and including, 2.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
ZoxPress - The All-In-One WordPress News
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update ZoxPress - The All-In-One WordPress News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 12, 2025ZoxPress - The All-In-One WordPress News: Unauthorized modification of data that can lead to privilege escalationCVE-2024-13653 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' functions in all versions up to, and including, 2.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
ZoxPress - The All-In-One WordPress News
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update ZoxPress - The All-In-One WordPress News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 12, 2025WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon: Unauthorized modification of dataCVE-2024-12164 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwp_reset_settings() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
Product
WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon
Affected
up to 1.6
What to do
Affects up to 1.6. Update WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.