Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
574 results · page 6 of 12
May 15, 2025The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private postsCVE-2024-12767 · WordPress plugins & themes · reported by WPScanLow 3.5
The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts
- Product
- buddyboss-platform
- Fixed in
- 2.7.60
- What to do
- Update buddyboss-platform to 2.7.60 or newer.
May 15, 2025WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2024-11109 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Google Review Slider
- Fixed in
- 15.6
- What to do
- Update WP Google Review Slider to 15.6 or newer.
May 10, 2025WordPress Review Plugin: The Ultimate Solution for Building a Review Website: Local File InclusionCVE-2025-2158 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Review Plugin: The Ultimate Solution for Building a Review Website plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.3.5 via the Post custom fields. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP file types can be uploaded and included, or pearcmd is enabled on a server with register_argc_argv also enabled.
- Product
- WordPress Review Plugin: The Ultimate Solution for Building a Review Website
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update WordPress Review Plugin: The Ultimate Solution for Building a Review Website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2025Wbcom Designs - Activity Link Preview For BuddyPress: Server-Side Request Forgery (SSRF)CVE-2025-47548 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress activity-link-preview-for-buddypress allows Server Side Request Forgery.This issue affects Wbcom Designs - Activity Link Preview For BuddyPress: from n/a through <= 1.4.4.
- Product
- Wbcom Designs - Activity Link Preview For BuddyPress
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Wbcom Designs - Activity Link Preview For BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2025Xavin's Review Ratings: Stored Cross-Site ScriptingCVE-2025-4170 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Xavin's Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Xavin's Review Ratings
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Xavin's Review Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 30, 2025Page View Count: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-2816 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellow_message_dontshow() function in versions 2.8.0 to 2.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to one on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
- Product
- Page View Count
- Affected
- 2.8.0 to 2.8.4
- What to do
- Affects 2.8.0 to 2.8.4. Update Page View Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 24, 2025360 View: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46509 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey Mikhalchuk 360 View 360-view allows Stored XSS.This issue affects 360 View: from n/a through <= 1.1.0.
- Product
- 360 View
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update 360 View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 19, 2025Wordpress Plugin Smart Product Review: Arbitrary file uploadsCVE-2021-4455 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Wordpress Plugin Smart Product Review
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Wordpress Plugin Smart Product Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordexploit-db.comwordfence.com
Apr 17, 2025Login Manager – Design Login Page, View Login Activity, Limit Login Attempts: Stored Cross-Site ScriptingCVE-2025-2613 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Login Manager – Design Login Page, View Login Activity, Limit Login Attempts
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Login Manager – Design Login Page, View Login Activity, Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 17, 2025Starfish Review Generation & Marketing: Missing AuthorizationCVE-2025-39533 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Starfish Reviews Starfish Review Generation & Marketing starfish-reviews allows Privilege Escalation.This issue affects Starfish Review Generation & Marketing: from n/a through <= 3.1.19.
- Product
- Starfish Review Generation & Marketing
- Affected
- up to 3.1.19
- What to do
- Affects up to 3.1.19. Update Starfish Review Generation & Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Review Wave – Google Places Reviews: Cross-Site Request Forgery (CSRF)CVE-2025-39442 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in MessageMetric Review Wave – Google Places Reviews review-wave-google-places-reviews allows Stored XSS.This issue affects Review Wave – Google Places Reviews: from n/a through <= 1.4.7.
- Product
- Review Wave – Google Places Reviews
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Review Wave – Google Places Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Google Maps GPX Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27313 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bernd Altmeier Google Maps GPX Viewer google-maps-gpx-viewer allows Reflected XSS.This issue affects Google Maps GPX Viewer: from n/a through <= 3.6.
- Product
- Google Maps GPX Viewer
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update Google Maps GPX Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Error Log Viewer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32681 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Guru Error Log Viewer error-log-viewer-wp allows Blind SQL Injection.This issue affects Error Log Viewer: from n/a through <= 1.0.5.
- Product
- Error Log Viewer
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Error Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Review Stars Count For WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32687 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magnigenie Review Stars Count For WooCommerce review-stars-count-for-woocommerce allows SQL Injection.This issue affects Review Stars Count For WooCommerce: from n/a through <= 2.0.
- Product
- Review Stars Count For WooCommerce
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Review Stars Count For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Review Stream: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32680 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Grade Us, Inc. Review Stream review-stream allows Stored XSS.This issue affects Review Stream: from n/a through <= 1.6.7.
- Product
- Review Stream
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Review Stream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025SwiftXR (3D/AR/VR) Viewer: Cross-Site Request Forgery (CSRF)CVE-2025-32248 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SwiftXR SwiftXR (3D/AR/VR) Viewer swiftxr-3darvr-viewer allows Cross Site Request Forgery.This issue affects SwiftXR (3D/AR/VR) Viewer: from n/a through <= 1.0.7.
- Product
- SwiftXR (3D/AR/VR) Viewer
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update SwiftXR (3D/AR/VR) Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Just Post Preview Widget: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32156 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Prokopenko / JustCoded Just Post Preview Widget just-post-preview allows PHP Local File Inclusion.This issue affects Just Post Preview Widget: from n/a through <= 1.1.1.
- Product
- Just Post Preview Widget
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Just Post Preview Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025MediaView: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31898 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dustinscarberry MediaView mediaview allows Reflected XSS.This issue affects MediaView: from n/a through <= 1.1.2.
- Product
- MediaView
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update MediaView to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Free Woocommerce Product Table View: Missing AuthorizationCVE-2025-31758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Free Woocommerce Product Table View: from n/a through <= 1.78.
- Product
- Free Woocommerce Product Table View
- Affected
- up to 1.78
- What to do
- Affects up to 1.78. Update Free Woocommerce Product Table View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2025Shopper Approved Reviews: Unauthorized modification of data that can lead to privilege escalationCVE-2025-3063 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Shopper Approved Reviews
- Affected
- 2.0 to 2.1
- What to do
- Affects 2.0 to 2.1. Update Shopper Approved Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-31886 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.21.
- Product
- Social proof testimonials and reviews by Repuso
- Affected
- up to 5.21
- What to do
- Affects up to 5.21. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Review Manager: Missing AuthorizationCVE-2025-31836 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in matthewrubin Review Manager review-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Review Manager: from n/a through <= 2.5.0.
- Product
- Review Manager
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Review Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Free Woocommerce Product Table View: Missing AuthorizationCVE-2025-31757 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Free Woocommerce Product Table View: from n/a through <= 1.78.
- Product
- Free Woocommerce Product Table View
- Affected
- up to 1.78
- What to do
- Affects up to 1.78. Update Free Woocommerce Product Table View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025WP Link Preview: Server-Side Request Forgery (SSRF)CVE-2025-31527 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview wp-link-preview allows Server Side Request Forgery.This issue affects WP Link Preview: from n/a through <= 1.4.1.
- Product
- WP Link Preview
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WP Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Simplebooklet PDF Viewer and Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30922 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simplebooklet Simplebooklet PDF Viewer and Embedder simplebooklet allows Stored XSS.This issue affects Simplebooklet PDF Viewer and Embedder: from n/a through <= 1.1.1.
- Product
- Simplebooklet PDF Viewer and Embedder
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Simplebooklet PDF Viewer and Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Trust.Reviews: Missing AuthorizationCVE-2025-30883 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trust.Reviews: from n/a through <= 2.3.
- Product
- Trust.Reviews
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Trust.Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025TWB Woocommerce Reviews: Cross-Site Request Forgery (CSRF)CVE-2025-30801 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Abu Bakar TWB Woocommerce Reviews twb-woocommerce-reviews allows Cross Site Request Forgery.This issue affects TWB Woocommerce Reviews: from n/a through <= 1.7.7.
- Product
- TWB Woocommerce Reviews
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update TWB Woocommerce Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WP Google Street View: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30799 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup WP Google Street View wp-google-street-view allows Stored XSS.This issue affects WP Google Street View: from n/a through <= 1.1.5.
- Product
- WP Google Street View
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update WP Google Street View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WP Google Review Slider: Cross-Site Request Forgery (CSRF)CVE-2025-30783 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP Google Review Slider: from n/a through <= 16.0.
- Product
- WP Google Review Slider
- Affected
- up to 16.0
- What to do
- Affects up to 16.0. Update WP Google Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025MediaView: Reflected Cross-Site ScriptingCVE-2025-2481 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MediaView plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id' parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- MediaView
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update MediaView to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 26, 2025Lightview Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28890 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Lightview Plus lightview-plus allows Reflected XSS.This issue affects Lightview Plus: from n/a through <= 3.1.3.
- Product
- Lightview Plus
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Lightview Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025AppReview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23714 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in podspod AppReview appreview allows Reflected XSS.This issue affects AppReview: from n/a through <= 0.2.9.
- Product
- AppReview
- Affected
- up to 0.2.9
- What to do
- Affects up to 0.2.9. Update AppReview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Beautiful Link Preview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30536 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview beautiful-link-preview allows Stored XSS.This issue affects Beautiful Link Preview: from n/a through <= 1.5.0.
- Product
- Beautiful Link Preview
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Beautiful Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2025Site Reviews: Does not properly sanitise and escape some of its Review fieldsCVE-2025-1232 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks
- Product
- Site Reviews
- Fixed in
- 7.2.5
- What to do
- Update Site Reviews to 7.2.5 or newer.
Mar 11, 2025Review Schema: Local File InclusionCVE-2025-1707 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
- Product
- Review Schema
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Review Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 8, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Stored Cross-Site ScriptingCVE-2024-12119 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the default_gallery_title_size parameter in all versions up to, and including, 2.4.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with granted gallery and album creator roles, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
- Affected
- up to 2.4.29
- What to do
- Affects up to 2.4.29. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Mar 8, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Insecure Direct Object ReferenceCVE-2024-12114 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogallery_attachment_modal_save AJAX action due to missing validation on a user controlled key (img_id). This makes it possible for authenticated attackers, with granted access and above, to update arbitrary post and page content. This requires the Gallery Creator Role setting to be a value lower than 'Editor' for there to be any real impact.
- Product
- FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
- Affected
- up to 2.4.29
- What to do
- Affects up to 2.4.29. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Mar 3, 2025GPX Viewer: Path Traversal: '.../...//'CVE-2025-27274 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Path Traversal: '.../...//' vulnerability in axelkeller GPX Viewer gpx-viewer allows Path Traversal.This issue affects GPX Viewer: from n/a through <= 2.2.11.
- Product
- GPX Viewer
- Affected
- up to 2.2.11
- What to do
- Affects up to 2.2.11. Update GPX Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Album Reviewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25070 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ed atrero Album Reviewer albumreviewer allows Stored XSS.This issue affects Album Reviewer: from n/a through <= 2.0.2.
- Product
- Album Reviewer
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Album Reviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025WP Ultimate Reviews FREE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23739 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtibbles WP Ultimate Reviews FREE wp-ultimate-reviews-free allows Reflected XSS.This issue affects WP Ultimate Reviews FREE: from n/a through <= 1.0.2.
- Product
- WP Ultimate Reviews FREE
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Ultimate Reviews FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable.CVE-2025-22624 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 5.1
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/extensions/albums/admin/class-meta boxes.php.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfluidattacks.comwordpress.org
Feb 25, 2025WP Yelp Review Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26946 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider wp-yelp-review-slider allows Blind SQL Injection.This issue affects WP Yelp Review Slider: from n/a through <= 8.1.
- Product
- WP Yelp Review Slider
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update WP Yelp Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Phee's LinkPreview: Cross-Site Request Forgery (CSRF)CVE-2025-27344 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in filipstepanov Phee's LinkPreview linkpreview allows Cross Site Request Forgery.This issue affects Phee's LinkPreview: from n/a through <= 1.6.7.
- Product
- Phee's LinkPreview
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Phee's LinkPreview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2025Simplebooklet PDF Viewer and Embedder: Stored Cross-Site ScriptingCVE-2024-13588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' shortcode in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simplebooklet PDF Viewer and Embedder
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Simplebooklet PDF Viewer and Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 16, 2025WP Airbnb Review Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26755 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider wp-airbnb-review-slider allows Blind SQL Injection.This issue affects WP Airbnb Review Slider: from n/a through <= 3.9.
- Product
- WP Airbnb Review Slider
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update WP Airbnb Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025Puzzles | WP Magazine / Review with Store WordPress Theme + RTL: PHP Object InjectionCVE-2024-13770 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of untrusted input 'view_more_posts' AJAX action. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The developer opted to remove the software from the repository, so an update is not available and it is recommended to find a replacement software.
- Product
- Puzzles | WP Magazine / Review with Store WordPress Theme + RTL
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update Puzzles | WP Magazine / Review with Store WordPress Theme + RTL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 12, 2025Puzzles | WP Magazine / Review with Store WordPress Theme + RTL: Stored Cross-Site ScriptingCVE-2024-13769 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'theme_options_ajax_post_action' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and inject malicious web scripts. The developer opted to remove the software from the repository, so an update is not available and it is recommended to find a replacement software.
- Product
- Puzzles | WP Magazine / Review with Store WordPress Theme + RTL
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update Puzzles | WP Magazine / Review with Store WordPress Theme + RTL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 7, 2025Music Sheet Viewer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-25155 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in efreja Music Sheet Viewer music-sheet-viewer allows Path Traversal.This issue affects Music Sheet Viewer: from n/a through <= 4.1.
- Product
- Music Sheet Viewer
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Music Sheet Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025URL-Preview-Box: Cross-Site Request Forgery (CSRF)CVE-2025-25104 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mraliende URL-Preview-Box good-url-preview-box allows Cross Site Request Forgery.This issue affects URL-Preview-Box: from n/a through <= 1.20.
- Product
- URL-Preview-Box
- Affected
- up to 1.20
- What to do
- Affects up to 1.20. Update URL-Preview-Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Music Sheet Viewer: Arbitrary File ReadCVE-2024-13671 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the read_score_file() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-25155 is likely a duplicate of this issue.
- Product
- Music Sheet Viewer
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Music Sheet Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.