Updated 25 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

519new WordPress flaws this week

395,110entries in the database

19,408 results · page 67 of 389

Jun 3, 2025Post Slider and Post Carousel with Post Vertical Scrolling Widget: Does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embedCVE-2025-4567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Post Slider and Post Carousel with Post Vertical Scrolling Widget
Fixed in
3.2.10
What to do
Update Post Slider and Post Carousel with Post Vertical Scrolling Widget to 3.2.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 3, 2025FancyBox for: Does not escape captions and titles attributes before using them to populate galleries' caption fieldsCVE-2025-3662 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS
Product
FancyBox for
Fixed in
3.3.6
What to do
Update FancyBox for to 3.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 3, 2025Newsletter: Does not sanitise and escape some of its Subscription settingsCVE-2025-3584 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Newsletter
Fixed in
8.8.2
What to do
Update Newsletter to 8.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 2, 2025WP-Optimize: Does not properly escape user inputCVE-2025-3951 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.
Product
WP-Optimize
Fixed in
4.2.0
What to do
Update WP-Optimize to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 2, 2025Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro: Does not sanitise and escape some of its settingsCVE-2025-1485 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro
Fixed in
5.1.6
What to do
Update Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro to 5.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Jun 1, 2025IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the sCVE-2025-33005 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.3
IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.
Product
Planning Analytics Local
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
May 30, 2025Gearside Developer Dashboard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-4429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Gearside Developer Dashboard
Affected
up to 1.0.72
What to do
Affects up to 1.0.72. Update Gearside Developer Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 27, 2025Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bCVE-2025-40911 · Other software · RRWO · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.5
Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation. Net::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.
Product
Net::CIDR::Set
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.urth.org github.com
May 26, 2025Screen 5.0.0 when it runs with setuid-root privileges does not drop privileges while operating on a user supplied path.CVE-2025-23395 · Other software · reported by meissner@suse.deHigh 7.3
Screen 5.0.0 when it runs with setuid-root privileges does not drop privileges while operating on a user supplied path. This allows unprivileged users to create files in arbitrary locations with `root` ownership, the invoking user's (real) group ownership and file mode 0644. All data written to the Screen PTY will be logged into this file, allowing to escalate to root privileges
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.suse.com openwall.com
May 23, 2025On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which allows authenticated CVE-2023-34873 · Other software · MOBOTIX · reported by MITREHigh 8.7
On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which allows authenticated users to execute code.
Product
P3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov mobotix.com
May 23, 2025Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users.CVE-2025-3894 · Other software · Jan Syski · reported by cvd@cert.plMedium 4.8
Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privileges are required. Version 5.20 of MegaBIP fixes this issue.
Product
MegaBIP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl megabip.pl
May 22, 2025When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configuCVE-2025-2506 · Other software · EnterpriseDB · reported by 20be33e2-bf35-4d13-8fad-18bd2f3e3659Medium 5.3
When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglogical command to obtain read access to replicated tables. When pglogical runs it should verify it is running on a replication connection but does not perform this check. This vulnerability was introduced in the pglogical 3.x codebase, which is proprietary to EDB. The same code base has been integrated into BDR/PGD 4 and 5. To exploit the vulnerability the attacker needs at least CONNECT permissions to a database configured for replication and must understand a number of pglogical3/BDR specific commands and be able to decode the binary protocol.
Product
pglogical
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record enterprisedb.com
May 22, 2025Blog2Social: Social Media Auto Post & Scheduler: Does not escape the title of postsCVE-2025-4133 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks.
Product
Blog2Social: Social Media Auto Post & Scheduler
Fixed in
8.4.0
What to do
Update Blog2Social: Social Media Auto Post & Scheduler to 8.4.0 or newer.
Full record and what to do →NVD record wpscan.com
May 21, 2025DIGITS: WordPress Mobile Number Signup and Login: Does not rate limit OTP validation attemptsCVE-2025-4094 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
Product
DIGITS: WordPress Mobile Number Signup and Login
Fixed in
8.4.6.1
What to do
Update DIGITS: WordPress Mobile Number Signup and Login to 8.4.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 20, 2025In the Linux kernel, the following vulnerability has been resolved: riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL When userspace does PR_SET_TAGGED_ACVE-2025-37966 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL When userspace does PR_SET_TAGGED_ADDR_CTRL, but Supm extension is not available, the kernel crashes: Oops - illegal instruction [#1] [snip] epc : set_tagged_addr_ctrl+0x112/0x15a ra : set_tagged_addr_ctrl+0x74/0x15a epc : ffffffff80011ace ra : ffffffff80011a30 sp : ffffffc60039be10 [snip] status: 0000000200000120 badaddr: 0000000010a79073 cause: 0000000000000002 set_tagged_addr_ctrl+0x112/0x15a __riscv_sys_prctl+0x352/0x73c do_trap_ecall_u+0x17c/0x20c andle_exception+0x150/0x15c Fix it by checking if Supm is available.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
May 20, 2025Order Delivery Date: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-2929 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Order Delivery Date
Fixed in
12.4.0
What to do
Update Order Delivery Date to 12.4.0 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2561 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ninja Forms
Fixed in
3.10.1
What to do
Update Ninja Forms to 3.10.1 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2560 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ninja Forms
Fixed in
3.10.1
What to do
Update Ninja Forms to 3.10.1 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2524 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ninja Forms
Fixed in
3.10.1
What to do
Update Ninja Forms to 3.10.1 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025Qi Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-1627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Qi Blocks
Fixed in
1.4
What to do
Update Qi Blocks to 1.4 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025Qi Blocks: Does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embedCVE-2025-1626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Qi Blocks
Fixed in
1.4
What to do
Update Qi Blocks to 1.4 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025Qi Blocks: Does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embedCVE-2025-1625 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Qi Blocks
Fixed in
1.4
What to do
Update Qi Blocks to 1.4 or newer.
Full record and what to do →NVD record wpscan.com
May 17, 2025CSV Mass Importer: Does not properly validate uploaded filesCVE-2025-4190 · WordPress plugins & themes · reported by WPScanHigh 7.2
The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
CSV Mass Importer
Affected
up to 1.2
What to do
Affects up to 1.2. Update CSV Mass Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2025Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attackeCVE-2025-32407 · Computers, phones & browsers · Samsung · reported by MITREMedium 5.9
Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attacker to impersonate any and all websites visited by the user. This is a critical misconfiguration in the way the browser validates the identity of the server. It negates the use of HTTPS as a secure channel, allowing for Man-in-the-Middle attacks, stealing sensitive information or modifying incoming and outgoing traffic. NOTE: This vulnerability is in an end-of-life product that is no longer maintained by the vendor.
Product
Internet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 16, 2025PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms.CVE-2025-40629 · Other software · PNETLab · reported by cve-coordination@incibe.esHigh 8.7
PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory.
Product
PNETLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
May 16, 2025Simple Lightbox: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3516 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Simple Lightbox
Fixed in
2.9.4
What to do
Update Simple Lightbox to 2.9.4 or newer.
Full record and what to do →NVD record wpscan.com
May 16, 2025Contact Form builder with drag & drop for WordPress: Does not sanitise and escape some of its settingsCVE-2025-3201 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
Product
Contact Form builder with drag & drop for WordPress
Fixed in
2.4.3
What to do
Update Contact Form builder with drag & drop for WordPress to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025WP-PManager: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2248 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
WP-PManager
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025WP-PManager: Does not have CSRF check in placeCVE-2025-2247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP-PManager
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025FunnelKit: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
FunnelKit
Fixed in
3.10.2
What to do
Update FunnelKit to 3.10.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Ninja Pages: Does not sanitise and escape some of its settingsCVE-2025-1454 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ninja Pages
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Ninja Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025Plugin Oficial: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1303 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
Product
Plugin Oficial
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Plugin Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Plugin Oficial: Does not sanitise and escape some of its settingsCVE-2025-1289 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Plugin Oficial
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Plugin Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025WOOEXIM: Does not have CSRF check in some placesCVE-2025-1288 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack.
Product
WOOEXIM
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Download HTML TinyMCE Button: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1286 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Download HTML TinyMCE Button
Affected
up to 1.2
What to do
Affects up to 1.2. Update Download HTML TinyMCE Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Badgearoo: Does not sanitise and escape some of its settingsCVE-2025-1033 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Badgearoo
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Badgearoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0688 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
Product
Spiritual Gifts Survey (and optional S.H.A.P.E survey)
Affected
up to 0.9.10
What to do
Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0687 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
Product
Spiritual Gifts Survey (and optional S.H.A.P.E survey)
Affected
up to 0.9.10
What to do
Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025AI ChatBot for WordPress: Does not sanitise and escape some of its settingsCVE-2025-0329 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
AI ChatBot for WordPress
Fixed in
6.2.4
What to do
Update AI ChatBot for WordPress to 6.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses: Does not sanitise and escape some of its settingsCVE-2024-9882 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses
Fixed in
1.9.4
What to do
Update Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses to 1.9.4 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9879 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Melapress File Monitor
Fixed in
2.1.1
What to do
Update Melapress File Monitor to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Auto Affiliate Links: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Auto Affiliate Links
Fixed in
6.4.7
What to do
Update Auto Affiliate Links to 6.4.7 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Taskbuilder: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9831 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Taskbuilder
Fixed in
3.0.9
What to do
Update Taskbuilder to 3.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9711 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9709 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025CYAN Backup: Does not sanitise and escape some of its settingsCVE-2024-9663 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
CYAN Backup
Fixed in
2.5.3
What to do
Update CYAN Backup to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025CYAN Backup: Does not sanitise and escape some of its settingsCVE-2024-9662 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
CYAN Backup
Fixed in
2.5.3
What to do
Update CYAN Backup to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-9645 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry
Fixed in
2.2.93
What to do
Update Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry to 2.2.93 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Popup Box: Does not sanitise and escape some of its settingsCVE-2024-9599 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Popup Box
Fixed in
4.7.8
What to do
Update Popup Box to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Free Booking Plugin for Hotels, Restaurants and Car Rentals: Does not have CSRF check in placeCVE-2024-9450 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack
Product
Free Booking Plugin for Hotels, Restaurants and Car Rentals
Fixed in
1.3.15
What to do
Update Free Booking Plugin for Hotels, Restaurants and Car Rentals to 1.3.15 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.