Vulnerability database

9,092 results · page 95 of 182

• Feb 14, 2025HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce: Stored Cross-Site ScriptingCVE-2024-13735 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping of a campaign name. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce

  Affected

  up to 2.11.2

  What to do

  Affects up to 2.11.2. Update HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddocs.hurrytimer.complugins.trac.wordpress.org

• Feb 14, 2025Qubely – Advanced Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2024-9601 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-26767 is a duplicate of this issue.

  Product

  Qubely – Advanced Gutenberg Blocks

  Affected

  up to 1.8.12

  What to do

  Affects up to 1.8.12. Update Qubely – Advanced Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 14, 2025Forminator Forms: Does not sanitise and escape some of its settingsCVE-2024-7052 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

  Product

  Forminator Forms

  Fixed in

  1.38.3

  What to do

  Update Forminator Forms to 1.38.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Feb 13, 2025TinyMCE Advanced qTranslate fix editor problems: Cross-Site Request Forgery (CSRF)CVE-2025-26582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems allows Stored XSS.This issue affects TinyMCE Advanced qTranslate fix editor problems: from n/a through <= 1.0.0.

  Product

  TinyMCE Advanced qTranslate fix editor problems

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update TinyMCE Advanced qTranslate fix editor problems to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025WP Directorybox Manager: Authentication BypassCVE-2024-13182 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator.

  Product

  WP Directorybox Manager

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WP Directorybox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordlocalhostwordfence.com

• Feb 13, 2025DethemeKit For Elementor: Information ExposureCVE-2025-0661 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, draft, or scheduled posts that they should not have access to by duplicating the post.

  Product

  DethemeKit For Elementor

  Affected

  up to 2.36

  What to do

  Affects up to 2.36. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 13, 2025Puzzles: Stored Cross-Site ScriptingCVE-2025-0837 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Puzzles

  Affected

  up to 4.2.6

  What to do

  Affects up to 4.2.6. Update Puzzles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• Feb 13, 2025Puzzles | WP Magazine / Review with Store WordPress Theme + RTL: PHP Object InjectionCVE-2024-13770 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of untrusted input 'view_more_posts' AJAX action. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The developer opted to remove the software from the repository, so an update is not available and it is recommended to find a replacement software.

  Product

  Puzzles | WP Magazine / Review with Store WordPress Theme + RTL

  Affected

  up to 4.2.4

  What to do

  Affects up to 4.2.4. Update Puzzles | WP Magazine / Review with Store WordPress Theme + RTL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• Feb 13, 2025Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Stored Cross-Site ScriptingCVE-2024-13227 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Rank Math API in all versions up to, and including, 1.0.235 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

  Affected

  up to 1.0.235

  What to do

  Affects up to 1.0.235. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 12, 2025DethemeKit For Elementor: Stored Cross-Site ScriptingCVE-2024-13644 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's De Gallery widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  DethemeKit For Elementor

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 12, 2025Brizy – Page Builder: Stored Cross-Site ScriptingCVE-2024-10322 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  Brizy – Page Builder

  Affected

  up to 2.6.8

  What to do

  Affects up to 2.6.8. Update Brizy – Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 12, 2025Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2025-0511 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Welcart e-Commerce

  Affected

  up to 2.11.9

  What to do

  Affects up to 2.11.9. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 12, 2025Small Package Quotes – Purolator Edition: SQL InjectionCVE-2024-13532 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Small Package Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  Small Package Quotes – Purolator Edition

  Affected

  up to 3.6.4

  What to do

  Affects up to 3.6.4. Update Small Package Quotes – Purolator Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 12, 2025Rise Blocks – A Complete Gutenberg Page Builder: Stored Cross-Site ScriptingCVE-2025-0506 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the titleTag parameter in all versions up to, and including, 3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Rise Blocks – A Complete Gutenberg Page Builder

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update Rise Blocks – A Complete Gutenberg Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 12, 2025FuseDesk: Stored Cross-Site ScriptingCVE-2024-13459 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' shortcode in all versions up to, and including, 6.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  FuseDesk

  Affected

  up to 6.6.1

  What to do

  Affects up to 6.6.1. Update FuseDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Feb 12, 2025Easy Quiz Maker: Stored Cross-Site ScriptingCVE-2024-13456 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Easy Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wqt-question' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Easy Quiz Maker

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Easy Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwordfence.com

• Feb 12, 2025Puzzles | WP Magazine / Review with Store WordPress Theme + RTL: Stored Cross-Site ScriptingCVE-2024-13769 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'theme_options_ajax_post_action' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and inject malicious web scripts. The developer opted to remove the software from the repository, so an update is not available and it is recommended to find a replacement software.

  Product

  Puzzles | WP Magazine / Review with Store WordPress Theme + RTL

  Affected

  up to 4.2.4

  What to do

  Affects up to 4.2.4. Update Puzzles | WP Magazine / Review with Store WordPress Theme + RTL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• Feb 12, 2025Admire Extra: Stored Cross-Site ScriptingCVE-2024-13665 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Admire Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'space' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Admire Extra

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Admire Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 12, 2025NGG Smart Image Search: Stored Cross-Site ScriptingCVE-2024-13658 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  NGG Smart Image Search

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 12, 2025Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands: Stored Cross-Site ScriptingCVE-2024-11746 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_brand' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 11, 2025Liveticker (by stklcode): Stored Cross-Site ScriptingCVE-2024-13701 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Liveticker (by stklcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Liveticker (by stklcode)

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Liveticker (by stklcode) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 11, 2025aDirectory – WordPress Directory Listing: Unauthorized loss of dataCVE-2024-13541 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqs_delete_listing() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.

  Product

  aDirectory – WordPress Directory Listing

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update aDirectory – WordPress Directory Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 11, 2025SuperSaaS – online appointment scheduling: Stored Cross-Site ScriptingCVE-2025-0862 · WordPress plugins & themes · reported by WordfenceMedium 4.9

  The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is limited to Chromium-based browsers (e.g. Chrome, Edge, Brave).

  Product

  SuperSaaS – online appointment scheduling

  Affected

  up to 2.1.12

  What to do

  Affects up to 2.1.12. Update SuperSaaS – online appointment scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 11, 2025GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2024-13506 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

  Affected

  up to 2.8.97

  What to do

  Affects up to 2.8.97. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 11, 2025HT Mega – Absolute Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-12599 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  HT Mega – Absolute Addons For Elementor

  Affected

  up to 2.8.1

  What to do

  Affects up to 2.8.1. Update HT Mega – Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 9, 2025Super Store Finder: SQL InjectionCVE-2024-13440 · WordPress plugins & themes · reported by WordfenceHigh 8.2

  The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all versions up to, and including, 7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into an already existing query to store cross-site scripting in store reviews.

  Product

  Super Store Finder

  Affected

  up to 7.0

  What to do

  Affects up to 7.0. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsuperstorefinder.networdfence.com

• Feb 8, 2025DWT - Directory & Listing: Stored Cross-Site ScriptingCVE-2025-0169 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  DWT - Directory & Listing

  Affected

  up to 3.3.4

  What to do

  Affects up to 3.3.4. Update DWT - Directory & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• Feb 8, 2025WP Directorybox Manager: Authentication bypassCVE-2025-0316 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

  Product

  WP Directorybox Manager

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WP Directorybox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• Feb 8, 2025Simple add pages or posts: Stored Cross-Site ScriptingCVE-2024-13850 · WordPress plugins & themes · reported by WordfenceMedium 5.5

  The Simple add pages or posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Product

  Simple add pages or posts

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Simple add pages or posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Feb 7, 2025Plugin A/B Image Optimizer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-25163 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through <= 3.3.

  Product

  Plugin A/B Image Optimizer

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Plugin A/B Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Music Sheet Viewer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-25155 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in efreja Music Sheet Viewer music-sheet-viewer allows Path Traversal.This issue affects Music Sheet Viewer: from n/a through <= 4.1.

  Product

  Music Sheet Viewer

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Music Sheet Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025OneStore Sites: Cross-Site Request Forgery (CSRF)CVE-2025-25107 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites onestore-sites allows Cross Site Request Forgery.This issue affects OneStore Sites: from n/a through <= 0.1.1.

  Product

  OneStore Sites

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update OneStore Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025WP Keyword Monitor: Cross-Site Request Forgery (CSRF)CVE-2025-25088 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyword Monitor: from n/a through <= 1.0.5.

  Product

  WP Keyword Monitor

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update WP Keyword Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 6, 2025Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: Path TraversalCVE-2025-0859 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.27.6 via the template_via_url() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

  Product

  Post and Page Builder by BoldGrid – Visual Drag and Drop Editor

  Affected

  up to 1.27.6

  What to do

  Affects up to 1.27.6. Update Post and Page Builder by BoldGrid – Visual Drag and Drop Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Feb 4, 2025World Cup Predictor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22794 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows Reflected XSS.This issue affects World Cup Predictor: from n/a through <= 1.9.8.

  Product

  World Cup Predictor

  Affected

  up to 1.9.8

  What to do

  Affects up to 1.9.8. Update World Cup Predictor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 4, 2025Qi Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-13699 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in versions 1.8.5, 1.8.6, and 1.8.7.

  Product

  Qi Addons For Elementor

  Affected

  up to 1.8.7

  What to do

  Affects up to 1.8.7. Update Qi Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2025SKT Blocks – Gutenberg based Page Builder: Stored Cross-Site ScriptingCVE-2024-13733 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's skt-blocks/post-carousel block in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-26771 is a duplicate of this issue.

  Product

  SKT Blocks – Gutenberg based Page Builder

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update SKT Blocks – Gutenberg based Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2025WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: Stored Cross-Site ScriptingCVE-2024-13403 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all versions up to, and including, 1.9.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

  Affected

  up to 1.9.3.1

  What to do

  Affects up to 1.9.3.1. Update WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2025Medical Addon for Elementor: Insecure Direct Object ReferenceCVE-2024-12046 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Medical Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.2 via the 'namedical_elementor_template' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the content of draft, pending, and private posts.

  Product

  Medical Addon for Elementor

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update Medical Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2025HT Mega – Absolute Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-12597 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_css' and 'inner_css' parameters in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  HT Mega – Absolute Addons For Elementor

  Affected

  up to 2.7.6

  What to do

  Affects up to 2.7.6. Update HT Mega – Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 3, 2025Eventer: Stored Cross-Site ScriptingCVE-2024-11132 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Eventer

  Affected

  up to 3.9.9.4

  What to do

  Affects up to 3.9.9.4. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodecanyon.networdfence.com

• Feb 3, 2025Custom WP Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24676 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator custom-store-locator allows Reflected XSS.This issue affects Custom WP Store Locator: from n/a through <= 1.4.7.

  Product

  Custom WP Store Locator

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update Custom WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WOLF: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-24605 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue affects WOLF: from n/a through <= 1.0.8.5.

  Product

  WOLF

  Affected

  up to 1.0.8.5

  What to do

  Affects up to 1.0.8.5. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025PDF Generator Addon for Elementor Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-24569 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Path Traversal.This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through <= 1.7.5.

  Product

  PDF Generator Addon for Elementor Page Builder

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update PDF Generator Addon for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025PlainInventory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Reflected XSS.This issue affects PlainInventory: from n/a through <= 3.1.5.

  Product

  PlainInventory

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update PlainInventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025WP Cloud: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-23819 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Marco Milesi WP Cloud cloud allows Absolute Path Traversal.This issue affects WP Cloud: from n/a through <= 1.4.3.

  Product

  WP Cloud

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update WP Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025.TUBE Video Curator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23799 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tubegtld .TUBE Video Curator tube-video-curator allows Reflected XSS.This issue affects .TUBE Video Curator: from n/a through <= 1.1.9.

  Product

  .TUBE Video Curator

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update .TUBE Video Curator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025VSTEMPLATE Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23491 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikash Srivastava VSTEMPLATE Creator vstemplate-creator allows Reflected XSS.This issue affects VSTEMPLATE Creator: from n/a through <= 2.0.2.

  Product

  VSTEMPLATE Creator

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update VSTEMPLATE Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025Traveler Layout Essential For Elementor: Server-Side Request Forgery (SSRF)CVE-2025-22701 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affects Traveler Layout Essential For Elementor: from n/a through < 1.4.

  Product

  Traveler Layout Essential For Elementor

  What to do

  Update Traveler Layout Essential For Elementor to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2025CF7 Google Sheets Connector: Missing AuthorizationCVE-2025-22686 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WesternDeal CF7 Google Sheets Connector cf7-google-sheets-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Google Sheets Connector: from n/a through <= 5.0.17.

  Product

  CF7 Google Sheets Connector

  Affected

  up to 5.0.17

  What to do

  Affects up to 5.0.17. Update CF7 Google Sheets Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.