Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

610 results · page 6 of 13

Mar 18, 2025The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: Arbitrary shortcode executionCVE-2025-2262 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.7.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025Thumbnail carousel slider: SQL InjectionCVE-2019-25222 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Thumbnail carousel slider plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Thumbnail carousel slider
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Thumbnail carousel slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025Bee Layer Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28879 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aumsrini Bee Layer Slider bee-layer-slider allows Stored XSS.This issue affects Bee Layer Slider: from n/a through <= 1.1.
Product
Bee Layer Slider
Affected
up to 1.1
What to do
Affects up to 1.1. Update Bee Layer Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2025Hero Slider - WordPress Slider: SQL InjectionCVE-2024-13809 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Hero Slider - WordPress Slider
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Hero Slider - WordPress Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 5, 2025Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-13757 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_layer shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.10.6
What to do
Affects up to 3.10.6. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 5, 2025Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-11731 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider shortcode in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue was partially fixed in version 3.10.8.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.10.7
Fixed in
3.10.8
What to do
Update Master Slider – Responsive Touch Slider to 3.10.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 3, 2025Ui Slider Filter By Price: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chenyenming Ui Slider Filter By Price ui-slider-filter-by-price allows Reflected XSS.This issue affects Ui Slider Filter By Price: from n/a through <= 1.1.
Product
Ui Slider Filter By Price
Affected
up to 1.1
What to do
Affects up to 1.1. Update Ui Slider Filter By Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Flexo Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23472 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio Flexo Slider flexo-slider allows Reflected XSS.This issue affects Flexo Slider: from n/a through <= 1.0013.
Product
Flexo Slider
Affected
up to 1.0013
What to do
Affects up to 1.0013. Update Flexo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Smooth Dynamic Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23447 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kundan Yevale Smooth Dynamic Slider smooth-dynamic-slider allows Reflected XSS.This issue affects Smooth Dynamic Slider: from n/a through <= 1.0.
Product
Smooth Dynamic Slider
Affected
up to 1.0
What to do
Affects up to 1.0. Update Smooth Dynamic Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2025The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2025-1517 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 25, 2025WP Yelp Review Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26946 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider wp-yelp-review-slider allows Blind SQL Injection.This issue affects WP Yelp Review Slider: from n/a through <= 8.1.
Product
WP Yelp Review Slider
Affected
up to 8.1
What to do
Affects up to 8.1. Update WP Yelp Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Image settingsCVE-2024-10545 · WordPress plugins & themes · reported by WPScanLow 3.5
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery, Sliders, Proofing and
Fixed in
3.59.9
What to do
Update Photo Gallery, Sliders, Proofing and to 3.59.9 or newer.
Full record and what to do →NVD record wpscan.com
Feb 24, 2025Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-12308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Logo Slider
Fixed in
4.6.0
What to do
Update Logo Slider to 4.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Feb 22, 2025Responsive Slider by MetaSlider: Deserialization of Untrusted DataCVE-2025-26763 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.94.0.
Product
Responsive Slider by MetaSlider
Affected
up to 3.94.0
What to do
Affects up to 3.94.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 21, 2025Carousel, Slider, Gallery by WP Carousel: Does not sanitise and escape some of its settingsCVE-2024-13314 · WordPress plugins & themes · reported by WPScanLow 3.5
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Carousel, Slider, Gallery by WP Carousel
Fixed in
2.7.4
What to do
Update Carousel, Slider, Gallery by WP Carousel to 2.7.4 or newer.
Full record and what to do →NVD record wpscan.com
Feb 19, 2025Master Slider: Does not sanitise and escape some of its settingsCVE-2024-12173 · WordPress plugins & themes · reported by WPScanLow 3.5
The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Master Slider
Fixed in
3.10.5
What to do
Update Master Slider to 3.10.5 or newer.
Full record and what to do →NVD record wpscan.com
Feb 17, 2025OWL Carousel Slider: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13627 · WordPress plugins & themes · reported by WPScanMedium 4.7
The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
OWL Carousel Slider
Affected
up to 2.2
What to do
Affects up to 2.2. Update OWL Carousel Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 16, 2025WP Airbnb Review Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26755 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider wp-airbnb-review-slider allows Blind SQL Injection.This issue affects WP Airbnb Review Slider: from n/a through <= 3.9.
Product
WP Airbnb Review Slider
Affected
up to 3.9
What to do
Affects up to 3.9. Update WP Airbnb Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025B Slider- Gutenberg Slider Block for WP: Information ExposureCVE-2024-13514 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb-slider' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private posts that they should not have access to.
Product
B Slider- Gutenberg Slider Block for WP
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update B Slider- Gutenberg Slider Block for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2025Post Carousel Slider: Cross-Site Request Forgery (CSRF)CVE-2025-23977 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Bhaskar Dhote Post Carousel Slider post-carousel-slider allows Stored XSS.This issue affects Post Carousel Slider: from n/a through <= 2.0.1.
Product
Post Carousel Slider
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Post Carousel Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025SlideDeck 1 Lite Content Slider: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13224 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SlideDeck 1 Lite Content Slider WordPress plugin through 1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
SlideDeck 1 Lite Content Slider
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update SlideDeck 1 Lite Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 30, 2025Gosign – Posts Slider Block: Stored Cross-Site ScriptingCVE-2024-13399 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gosign – Posts Slider Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posts-slider-block' block in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gosign – Posts Slider Block
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Gosign – Posts Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 30, 2025WE – Testimonial Slider: Stored Cross-Site ScriptingCVE-2024-13460 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WE – Testimonial Slider
Affected
up to 1.5
What to do
Affects up to 1.5. Update WE – Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 27, 2025Post Grid, Slider & Carousel Ultimate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24782 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclusion.This issue affects Post Grid, Slider & Carousel Ultimate: from n/a through <= 1.6.10.
Product
Post Grid, Slider & Carousel Ultimate
Affected
up to 1.6.10
What to do
Affects up to 1.6.10. Update Post Grid, Slider & Carousel Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 27, 2025Responsive Slider by MetaSlider: Cross-Site Request Forgery (CSRF)CVE-2025-24533 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Cross Site Request Forgery.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.92.0.
Product
Responsive Slider by MetaSlider
Affected
up to 3.92.0
What to do
Affects up to 3.92.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 27, 2025Crelly Slider: Does not sanitise and escape some of its settingsCVE-2024-13116 · WordPress plugins & themes · reported by WPScanLow 3.8
The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Crelly Slider
Fixed in
1.4.7
What to do
Update Crelly Slider to 1.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Jan 24, 2025Super Block Slider: Missing AuthorizationCVE-2025-24682 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Michael Super Block Slider super-block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Block Slider: from n/a through <= 2.7.9.
Product
Super Block Slider
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update Super Block Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Product Carousel Slider & Grid Ultimate for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24681 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate allows Stored XSS.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through <= 1.10.0.
Product
Product Carousel Slider & Grid Ultimate for WooCommerce
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update Product Carousel Slider & Grid Ultimate for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget: Local File InclusionCVE-2024-13409 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the post_type_ajax_handler() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget
Affected
up to 1.6.10
What to do
Affects up to 1.6.10. Update Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ja.wordpress.org plugins.trac.wordpress.org
Jan 24, 2025Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget: Local File InclusionCVE-2024-13408 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included.
Product
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget
Affected
up to 1.6.10
What to do
Affects up to 1.6.10. Update Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 23, 2025Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider): Stored Cross-Site ScriptingCVE-2024-12043 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'social_link_title' parameter of the 'blog' widget in all versions up to, and including, 3.16.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider)
Affected
up to 3.16.5
What to do
Affects up to 3.16.5. Update Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025Cyber Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23630 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Irshad A.Khan Cyber Slider cyber-new-slider allows Reflected XSS.This issue affects Cyber Slider: from n/a through <= 1.1.
Product
Cyber Slider
Affected
up to 1.1
What to do
Affects up to 1.1. Update Cyber Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025FWD Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23462 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anil Jailta FWD Slider fwd-slider allows Reflected XSS.This issue affects FWD Slider: from n/a through <= 1.0.
Product
FWD Slider
Affected
up to 1.0
What to do
Affects up to 1.0. Update FWD Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Len Slider: Cross-Site Request Forgery (CSRF)CVE-2025-23810 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Igor Sazonov Len Slider len-slider allows Reflected XSS.This issue affects Len Slider: from n/a through <= 2.0.11.
Product
Len Slider
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Len Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Slider for Writers: Cross-Site Request Forgery (CSRF)CVE-2025-23692 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in artanik Slider for Writers slider-for-writers allows Stored XSS.This issue affects Slider for Writers: from n/a through <= 1.3.
Product
Slider for Writers
Affected
up to 1.3
What to do
Affects up to 1.3. Update Slider for Writers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025NV Slider: Cross-Site Request Forgery (CSRF)CVE-2025-23661 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ryscript NV Slider nv-slider allows Stored XSS.This issue affects NV Slider: from n/a through <= 1.6.
Product
NV Slider
Affected
up to 1.6
What to do
Affects up to 1.6. Update NV Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Responsive jQuery Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer Responsive jQuery Slider responsive-jquery-slider allows Stored XSS.This issue affects Responsive jQuery Slider: from n/a through <= 1.1.1.
Product
Responsive jQuery Slider
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Responsive jQuery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025WP News Sliders: Missing AuthorizationCVE-2025-22779 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in codeaffairs WP News Sliders wp-news-sliders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP News Sliders: from n/a through <= 1.0.
Product
WP News Sliders
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP News Sliders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Post Carousel & Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22750 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel Post Carousel & Slider post-types-carousel-slider allows Reflected XSS.This issue affects Post Carousel & Slider: from n/a through <= 1.0.4.
Product
Post Carousel & Slider
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Post Carousel & Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 11, 2025Accordion Slider Lite: Stored Cross-Site ScriptingCVE-2024-11892 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Accordion Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'accordion_slider' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Accordion Slider Lite
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Accordion Slider Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025MG Parallax Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22330 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Parallax Slider mg-parallax-slider allows Reflected XSS.This issue affects MG Parallax Slider: from n/a through <= 1.0..
Product
MG Parallax Slider
Affected
up to 1.0.
What to do
Affects up to 1.0.. Update MG Parallax Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Smoothness Slider Shortcode: Cross-Site Request Forgery (CSRF)CVE-2025-22555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in njshofe Smoothness Slider Shortcode smoothness-slider-shortcode allows Cross Site Request Forgery.This issue affects Smoothness Slider Shortcode: from n/a through <= v1.2.2.
Product
Smoothness Slider Shortcode
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Smoothness Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor: Unauthorized access of dataCVE-2024-10536 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes.
Product
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its Gallery settingsCVE-2024-10102 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.22
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 6, 2025Slider Pro Lite: Stored Cross-Site ScriptingCVE-2024-11899 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider Pro Lite
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Slider Pro Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 31, 2024Gulri Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56223 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Gulri Slider gulri-slider allows Reflected XSS.This issue affects Gulri Slider: from n/a through <= 3.5.8.
Product
Gulri Slider
Affected
up to 3.5.8
What to do
Affects up to 3.5.8. Update Gulri Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Dynamic Product Category Grid, Slider for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-56230 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Maidul Dynamic Product Category Grid, Slider for WooCommerce dynamic-product-categories-design allows PHP Local File Inclusion.This issue affects Dynamic Product Category Grid, Slider for WooCommerce: from n/a through <= 1.1.3.
Product
Dynamic Product Category Grid, Slider for WooCommerce
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Dynamic Product Category Grid, Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 20, 2024Category Post Slider: Stored Cross-Site ScriptingCVE-2024-11878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Category Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'category-post-slider' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Category Post Slider
Affected
up to 1.4
What to do
Affects up to 1.4. Update Category Post Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 20, 2024Serious Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11108 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Serious Slider
Fixed in
1.2.7
What to do
Update Serious Slider to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Dec 16, 2024Ui Slider Filter By Price: Cross-Site Request Forgery (CSRF)CVE-2024-54419 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in chenyenming Ui Slider Filter By Price ui-slider-filter-by-price allows Cross Site Request Forgery.This issue affects Ui Slider Filter By Price: from n/a through <= 1.1.
Product
Ui Slider Filter By Price
Affected
up to 1.1
What to do
Affects up to 1.1. Update Ui Slider Filter By Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.