Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

9,083 results · page 66 of 182

Nov 10, 2025Skip to Timestamp: Stored Cross-Site ScriptingCVE-2025-11805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Skip to Timestamp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skipto' shortcode in all versions up to, and including, 1.4.4. This is due to insufficient input sanitization and output escaping on the 'time' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Skip to Timestamp
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Skip to Timestamp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Mementor Core: Privilege EscalationCVE-2025-11168 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality.
Product
Mementor Core
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Mementor Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Include Fussball.de Widgets: Stored Cross-Site ScriptingCVE-2025-11129 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Include Fussball.de Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api' and 'type' parameters in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Include Fussball.de Widgets
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Include Fussball.de Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025aThemes Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-12837 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user-supplied values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
aThemes Addons for Elementor
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025Saphali LiqPay for donate: Stored Cross-Site ScriptingCVE-2025-12643 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Saphali LiqPay for donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saphali_liqpay' shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Saphali LiqPay for donate
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Saphali LiqPay for donate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2025HTML Forms – Simple WordPress Forms: Stored Cross-Site ScriptingCVE-2025-12125 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
HTML Forms – Simple WordPress Forms
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update HTML Forms – Simple WordPress Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025Insert Headers and Footers Code – HT Script: Stored Cross-Site ScriptingCVE-2025-12112 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Insert Headers and Footers Code – HT Script
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Insert Headers and Footers Code – HT Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025WP Airbnb Review Slider: Stored Cross-Site ScriptingCVE-2025-12520 · WordPress plugins & themes · reported by WordfenceMedium 4
The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Airbnb Review Slider
Affected
up to 4.2
What to do
Affects up to 4.2. Update WP Airbnb Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cyberresearchhub.com cyberresearchhub.com
Nov 6, 2025King Addons for Elementor: Unrestricted Upload of File with Dangerous TypeCVE-2025-6327 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web Server.This issue affects King Addons for Elementor: from n/a through <= 51.1.36.
Product
King Addons for Elementor
Affected
up to 51.1.36
What to do
Affects up to 51.1.36. Update King Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025King Addons for Elementor: Incorrect Privilege AssignmentCVE-2025-6325 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in KingAddons.com King Addons for Elementor king-addons allows Privilege Escalation.This issue affects King Addons for Elementor: from n/a through <= 51.1.36.
Product
King Addons for Elementor
Affected
up to 51.1.36
What to do
Affects up to 51.1.36. Update King Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Cost Calculator Builder: Missing AuthorizationCVE-2025-62049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <= 3.5.32.
Product
Cost Calculator Builder
Affected
up to 3.5.32
What to do
Affects up to 3.5.32. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025TheGem (Elementor): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62041 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.1.
Product
TheGem (Elementor)
Affected
up to 5.10.5.1
What to do
Affects up to 5.10.5.1. Update TheGem (Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025AI ChatBot with ChatGPT and Content Generator by AYS: Insertion of Sensitive Information Into Sent DataCVE-2025-62039 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Retrieve Embedded Sensitive Data.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.6.6.
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025TheGem (Elementor): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62012 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.
Product
TheGem (Elementor)
Affected
up to 5.10.5
What to do
Affects up to 5.10.5. Update TheGem (Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Download Counter: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-60242 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through <= 1.4.
Product
Download Counter
Affected
up to 1.4
What to do
Affects up to 1.4. Update Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025WooCommerce Store Toolkit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60204 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach WooCommerce Store Toolkit woocommerce-store-toolkit allows PHP Local File Inclusion.This issue affects WooCommerce Store Toolkit: from n/a through <= 2.4.3.
Product
WooCommerce Store Toolkit
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update WooCommerce Store Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Store Exporter: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60203 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach Store Exporter woocommerce-exporter allows PHP Local File Inclusion.This issue affects Store Exporter: from n/a through <= 2.7.6.
Product
Store Exporter
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update Store Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Clearblue® Ovulation Calculator: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60196 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Clearblue Clearblue® Ovulation Calculator clearblue-ovulation-calculator allows PHP Local File Inclusion.This issue affects Clearblue® Ovulation Calculator: from n/a through <= 1.2.4.
Product
Clearblue® Ovulation Calculator
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Clearblue® Ovulation Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025GoStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup GoStore gostore allows Reflected XSS.This issue affects GoStore: from n/a through < 1.6.4.
Product
GoStore
What to do
Update GoStore to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Barcode Scanner with Inventory & Order Manager: Path Traversal: '.../...//'CVE-2025-58972 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Path Traversal: '.../...//' vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.10.4.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.10.4
What to do
Affects up to 1.10.4. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Institutions Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Institutions Directory institutions-directory allows Reflected XSS.This issue affects Institutions Directory: from n/a through <= 1.3.3.
Product
Institutions Directory
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Ai Image Alt Text Generator for WP: Missing AuthorizationCVE-2025-58207 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.5.
Product
Ai Image Alt Text Generator for WP
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 5, 2025Ad Inserter – Ad Manager & AdSense Ads: Stored Cross-Site ScriptingCVE-2025-11745 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field through the plugin's 'adinserter' shortcode in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ad Inserter – Ad Manager & AdSense Ads
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update Ad Inserter – Ad Manager & AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2025Visual Link Preview: Stored Cross-Site ScriptingCVE-2025-11987 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visual Link Preview
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Visual Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2025Graphina – Elementor Charts and Graphs: Stored Cross-Site ScriptingCVE-2025-11820 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Graphina – Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widgets in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping on data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects multiple chart widgets including Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart, and Advance Data Table widgets.
Product
Graphina – Elementor Charts and Graphs
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Graphina – Elementor Charts and Graphs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Nov 5, 2025ElementInvader Addons for Elementor: Allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form actionCVE-2025-10873 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.
Product
ElementInvader Addons for Elementor
Fixed in
1.4.1
What to do
Update ElementInvader Addons for Elementor to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2025Spectra Gutenberg Blocks – Website Builder for the Block Editor: Stored Cross-Site ScriptingCVE-2025-11162 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2.19.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spectra Gutenberg Blocks – Website Builder for the Block Editor
Affected
up to 2.19.14
What to do
Affects up to 2.19.14. Update Spectra Gutenberg Blocks – Website Builder for the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025MeetingList: Stored Cross-Site ScriptingCVE-2025-12184 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The MeetingList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
MeetingList
Affected
up to 0.11
What to do
Affects up to 0.11. Update MeetingList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.com wordfence.com
Nov 4, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor): Local File InclusionCVE-2025-12493 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor)
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Stored Cross-Site ScriptingCVE-2025-12045 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category and tag 'name' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025Pagerank Tools: Stored Cross-Site ScriptingCVE-2025-12416 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the pr_save_settings() function and insufficient input sanitization. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses the plugin's settings page.
Product
Pagerank Tools
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Pagerank Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025clubmember: Stored Cross-Site ScriptingCVE-2025-12396 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The clubmember plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
clubmember
Affected
up to 0.2
What to do
Affects up to 0.2. Update clubmember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.com wordfence.com
Nov 4, 2025Free Quotation: Stored Cross-Site ScriptingCVE-2025-12393 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Free Quotation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Free Quotation
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Free Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 4, 2025Nari Accountant: Stored Cross-Site ScriptingCVE-2025-12371 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Nari Accountant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via account settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Nari Accountant
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Nari Accountant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 4, 2025Extensions for Leaflet Map: Stored Cross-Site ScriptingCVE-2025-12369 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Extensions for Leaflet Map
Affected
up to 4.7
What to do
Affects up to 4.7. Update Extensions for Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025WP Carticon: Stored Cross-Site ScriptingCVE-2025-12065 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Carticon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carticon_js_script' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Carticon
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Carticon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 4, 2025Reuse Builder: Stored Cross-Site ScriptingCVE-2025-11812 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Reuse Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reuse_builder_single_post_title' shortcode in all versions up to, and including, 1.7. This is due to insufficient input sanitization and output escaping on the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Reuse Builder
Affected
up to 1.7
What to do
Affects up to 1.7. Update Reuse Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 4, 2025Bootstrap Multi-language Responsive Portfolio: Stored Cross-Site ScriptingCVE-2025-11753 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Bootstrap Multi-language Responsive Portfolio
Affected
up to 1.0
What to do
Affects up to 1.0. Update Bootstrap Multi-language Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Nov 4, 2025Footnotes Made Easy: Stored Cross-Site ScriptingCVE-2025-11733 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Footnotes Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Footnotes Made Easy
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Footnotes Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 3, 2025TablePress – Tables in WordPress made easy: Stored Cross-Site ScriptingCVE-2025-12324 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `table` shortcode attributes in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TablePress – Tables in WordPress made easy
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update TablePress – Tables in WordPress made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 3, 2025Greenshift – animation and page builder blocks: Stored Cross-Site ScriptingCVE-2025-11841 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versions up to, and including, 12.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Greenshift – animation and page builder blocks
Affected
up to 12.2.7
What to do
Affects up to 12.2.7. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2025kallyas: Stored Cross-Site ScriptingCVE-2025-6988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 4.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
kallyas
Affected
up to 4.23.0
What to do
Affects up to 4.23.0. Update kallyas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record my.hogash.com wordfence.com
Nov 1, 2025Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent: Arbitrary file uploadsCVE-2025-11499 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created.
Product
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
Affected
up to 1.1.32
What to do
Affects up to 1.1.32. Update Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2025Employee Spotlight – Team Member Showcase & Meet the Team: Stored Cross-Site ScriptingCVE-2025-12090 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Employee Spotlight – Team Member Showcase & Meet the Team
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update Employee Spotlight – Team Member Showcase & Meet the Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2025Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2025-11502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.51
What to do
Affects up to 1.51. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2025Schema Scalpel: Stored Cross-Site ScriptingCVE-2025-12118 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping when outputting user-supplied data into JSON-LD schema markup. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Schema Scalpel
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Schema Scalpel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 1, 2025Community Events: Stored Cross-Site ScriptingCVE-2025-11995 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Community Events
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Community Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2025Flying Images: Optimize and Lazy Load Images for Faster Page Speed: Stored Cross-Site ScriptingCVE-2025-11927 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Flying Images: Optimize and Lazy Load Images for Faster Page Speed
Affected
up to 2.4.14
What to do
Affects up to 2.4.14. Update Flying Images: Optimize and Lazy Load Images for Faster Page Speed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Nov 1, 2025CSS & JavaScript Toolbox: Stored Cross-Site ScriptingCVE-2025-11928 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
CSS & JavaScript Toolbox
Affected
up to 12.0.5
What to do
Affects up to 12.0.5. Update CSS & JavaScript Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 31, 2025Inactive Logout: Stored Cross-Site ScriptingCVE-2025-11922 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Inactive Logout
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Inactive Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.