Updated 7 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

761 results · page 8 of 16

Jul 4, 2025CMSMasters Content Composer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-4414 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows PHP Local File Inclusion.This issue affects CMSMasters Content Composer: from n/a through < 2.5.7.
Product
CMSMasters Content Composer
What to do
Update CMSMasters Content Composer to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 3, 2025PayMaster for WooCommerce: Server-Side Request ForgeryCVE-2025-6729 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
PayMaster for WooCommerce
Affected
up to 0.4.31
What to do
Affects up to 0.4.31. Update PayMaster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 2, 2025WP Front-end login and register: Reflected Cross-Site ScriptingCVE-2024-11405 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Front-end login and register
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Front-end login and register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 27, 2025WP DB Booster: Missing AuthorizationCVE-2025-53318 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPManiax WP DB Booster wp-db-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP DB Booster: from n/a through <= 1.0.1.
Product
WP DB Booster
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP DB Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WP Register Profile With Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50042 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Register Profile With Shortcode wp-register-profile-with-shortcode allows Stored XSS.This issue affects WP Register Profile With Shortcode: from n/a through <= 3.6.3.
Product
WP Register Profile With Shortcode
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update WP Register Profile With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2025-5291 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide shortcodes in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.10.8
What to do
Affects up to 3.10.8. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2025File Manager Pro – Filester: Arbitrary file uploadsCVE-2025-3234 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.8.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Administrators have the ability to extend file manager usage privileges to lower-level users including subscribers, which would make this vulnerability more severe on such sites.
Product
File Manager Pro – Filester
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2025WP Security Master: Cross-Site Request Forgery (CSRF)CVE-2025-49440 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Vuong Nguyen WP Security Master wp-security-master allows Cross Site Request Forgery.This issue affects WP Security Master: from n/a through <= 1.0.2.
Product
WP Security Master
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Security Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Konami Easter Egg: Cross-Site Request Forgery (CSRF)CVE-2025-49425 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft Konami Easter Egg konami-easter-egg allows Stored XSS.This issue affects Konami Easter Egg: from n/a through <= v0.4.
Product
Konami Easter Egg
Affected
up to 0.4
What to do
Affects up to 0.4. Update Konami Easter Egg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Post Grid Master: Missing AuthorizationCVE-2025-30974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid Master: from n/a through <= 3.4.17.
Product
Post Grid Master
Affected
up to 3.4.17
What to do
Affects up to 3.4.17. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 28, 2025MasterStudy LMS Pro: Arbitrary file uploadsCVE-2025-4800 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
Product
MasterStudy LMS Pro
Affected
up to 4.7.0
What to do
Affects up to 4.7.0. Update MasterStudy LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com stylemixthemes.com
May 23, 2025Tourmaster: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48292 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GoodLayers Tourmaster tourmaster allows PHP Local File Inclusion.This issue affects Tourmaster: from n/a through <= 5.3.8.
Product
Tourmaster
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update Tourmaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025WordPress Social Login and Register: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47670 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.6.10.
Product
WordPress Social Login and Register
Affected
up to 7.6.10
What to do
Affects up to 7.6.10. Update WordPress Social Login and Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Booster Plus for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39446 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflected XSS.This issue affects Booster Plus for WooCommerce: from n/a through 7.2.4.
Product
Booster Plus for WooCommerce
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update Booster Plus for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Master Slider: Missing AuthorizationCVE-2025-39412 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in averta Master Slider master-slider.This issue affects Master Slider: from n/a through <= 3.11.0.
Product
Master Slider
Affected
up to 3.11.0
What to do
Affects up to 3.11.0. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Masteriyo - LMS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-33939 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.3.
Product
Masteriyo - LMS
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Seznam Webmaster: Cross-Site Request Forgery (CSRF)CVE-2025-47523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Lukáš Hartmann Seznam Webmaster seznam-webmaster allows Cross Site Request Forgery.This issue affects Seznam Webmaster: from n/a through <= 1.4.7.
Product
Seznam Webmaster
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Seznam Webmaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Listamester: Cross-Site Request Forgery (CSRF)CVE-2025-47446 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in listamester Listamester listamester allows Cross Site Request Forgery.This issue affects Listamester: from n/a through <= 2.3.6.
Product
Listamester
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 28, 2025The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS.CVE-2015-4582 · WordPress plugins & themes · reported by MITREHigh 7.2
The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS. NOTE: CVE-2015-4582 is not assigned to any Oracle product.
Affected
1.6.4 to 1.6.4
What to do
Affects 1.6.4 to 1.6.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org
Apr 24, 2025Product Lister for eBay: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39384 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce Product Lister for eBay product-lister-ebay allows PHP Local File Inclusion.This issue affects Product Lister for eBay: from n/a through <= 2.0.9.
Product
Product Lister for eBay
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Product Lister for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025WPMasterToolKit (WPMTK) – All in one: Directory TraversalCVE-2025-3300 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on the server, which can contain sensitive information.
Product
WPMasterToolKit (WPMTK) – All in one
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update WPMasterToolKit (WPMTK) – All in one to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 17, 2025Page and Post Lister: Missing AuthorizationCVE-2025-27310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Radius of Thought Page and Post Lister page-and-post-lister allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page and Post Lister: from n/a through <= 1.2.1.
Product
Page and Post Lister
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Page and Post Lister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025FS Poster: Missing AuthorizationCVE-2025-30960 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.
Product
FS Poster
Affected
up to 6.5.8
What to do
Affects up to 6.5.8. Update FS Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Tourmaster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32923 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Tourmaster tourmaster allows Reflected XSS.This issue affects Tourmaster: from n/a through < 5.4.1.
Product
Tourmaster
What to do
Update Tourmaster to the newest version.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025FS Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30962 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fs-code FS Poster fs-poster allows Reflected XSS.This issue affects FS Poster: from n/a through <= 6.5.8.
Product
FS Poster
Affected
up to 6.5.8
What to do
Affects up to 6.5.8. Update FS Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025QR Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32116 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Studi7 QR Master qr-master allows Reflected XSS.This issue affects QR Master: from n/a through <= 1.0.5.
Product
QR Master
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update QR Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025WordPress 5sterrenspecialist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32114 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5sterrenspecialist WordPress 5sterrenspecialist Plugin 5-sterrenspecialist allows Reflected XSS.This issue affects WordPress 5sterrenspecialist Plugin: from n/a through <= 1.4.
Product
WordPress 5sterrenspecialist
Affected
up to 1.4
What to do
Affects up to 1.4. Update WordPress 5sterrenspecialist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025ePaper Lister for Yumpu: Cross-Site Request Forgery (CSRF)CVE-2025-32502 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in lemmentwickler ePaper Lister for Yumpu magazine-lister-for-yumpu allows Stored XSS.This issue affects ePaper Lister for Yumpu: from n/a through <= 1.4.0.
Product
ePaper Lister for Yumpu
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update ePaper Lister for Yumpu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-32237 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.
Product
MasterStudy LMS
Affected
up to 3.5.28
What to do
Affects up to 3.5.28. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025MasterStudy LMS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32141 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows PHP Local File Inclusion.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.
Product
MasterStudy LMS
Affected
up to 3.5.28
What to do
Affects up to 3.5.28. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Booster for WooCommerce: Stored Cross-Site ScriptingCVE-2024-13708 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Booster for WooCommerce
Affected
4.0.1 to 7.2.4
What to do
Affects 4.0.1 to 7.2.4. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2025Booster for WooCommerce: Arbitrary file uploadsCVE-2024-13744 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Booster for WooCommerce
Affected
4.0.1 to 7.2.4
What to do
Affects 4.0.1 to 7.2.4. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 3, 2025Team Rosters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31905 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O'Donnell Team Rosters team-rosters allows Reflected XSS.This issue affects Team Rosters: from n/a through <= 4.7.
Product
Team Rosters
Affected
up to 4.7
What to do
Affects up to 4.7. Update Team Rosters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Booster for WooCommerce: Stored Cross-Site ScriptingCVE-2024-12278 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via any location that typically sanitizes data using wp_kses, like comments, in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Booster for WooCommerce
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2025OK Poster Group: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svmidi OK Poster Group ok-poster-group allows Reflected XSS.This issue affects OK Poster Group: from n/a through <= 1.1.
Product
OK Poster Group
Affected
up to 1.1
What to do
Affects up to 1.1. Update OK Poster Group to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Microblog Poster: Cross-Site Request Forgery (CSRF)CVE-2025-31435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Efficient Scripts Microblog Poster microblog-poster allows Stored XSS.This issue affects Microblog Poster: from n/a through <= 2.1.6.
Product
Microblog Poster
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Microblog Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Hester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26734 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peregrinethemes Hester hester allows Stored XSS.This issue affects Hester: from n/a through <= 1.1.10.
Product
Hester
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Hester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Listamester: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30813 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.5.
Product
Listamester
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2025Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-10679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Quiz and Survey Master (QSM)
Fixed in
9.2.1
What to do
Update Quiz and Survey Master (QSM) to 9.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 15, 2025FS Poster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26978 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.
Product
FS Poster
Affected
up to 6.5.8
What to do
Affects up to 6.5.8. Update FS Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Pie Register Premium: Path TraversalCVE-2025-26940 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
Product
Pie Register Premium
Affected
up to 3.8.3.2
What to do
Affects up to 3.8.3.2. Update Pie Register Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 8, 2025miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon: Authentication bypassCVE-2024-11087 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
Product
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon
Affected
up to 200.3.9
What to do
Affects up to 200.3.9. Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record miniorange.com wordfence.com
Mar 5, 2025Homey Login Register: Privilege escalationCVE-2024-11951 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
Product
Homey Login Register
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Homey Login Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 5, 2025Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-13757 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_layer shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.10.6
What to do
Affects up to 3.10.6. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 5, 2025Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-11731 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider shortcode in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue was partially fixed in version 3.10.8.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.10.7
Fixed in
3.10.8
What to do
Update Master Slider – Responsive Touch Slider to 3.10.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 4, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2025-0433 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Affected
up to 2.0.7.1
What to do
Affects up to 2.0.7.1. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 4, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2024-9618 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Affected
up to 2.0.7.2
What to do
Affects up to 2.0.7.2. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record master-addons.com plugins.trac.wordpress.org
Feb 28, 2025Wp Social Login and Register Social Counter: Cross-Site Request ForgeryCVE-2025-1506 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. This is due to missing or incorrect nonce validation on the counter_access_key_setup() function. This makes it possible for unauthenticated attackers to update social login provider settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Wp Social Login and Register Social Counter
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2025Pie Register Premium: Missing AuthorizationCVE-2025-26948 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
Product
Pie Register Premium
Affected
up to 3.8.3.2
What to do
Affects up to 3.8.3.2. Update Pie Register Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025WP Social SEO Booster – Knowledge Graph Social Signals SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel WP Social SEO Booster – Knowledge Graph Social Signals SEO wp-social-seo-booster allows Stored XSS.This issue affects WP Social SEO Booster – Knowledge Graph Social Signals SEO: from n/a through <= 1.2.0.
Product
WP Social SEO Booster – Knowledge Graph Social Signals SEO
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WP Social SEO Booster – Knowledge Graph Social Signals SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.