Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Jun 9, 2026KittyCatfish 2.2: SQL injectionCVE-2017-20246 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter. Attackers can inject SQL code through the 'kc_ad' parameter in base.css.php or kittycatfish.php to extract sensitive database information using boolean-based blind or time-based blind techniques.
- Product
- KittyCatfish 2.2
- What to do
- Update KittyCatfish 2.2 to the newest version.
Full record and what to do →NVD recordtad.groupwordpress.org
May 19, 2026Bigfishgames Syndicate: Cross-Site Request ForgeryCVE-2026-6452 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the bigfishgames_syndicate_submenu() function. This makes it possible for unauthenticated attackers to reset plugin settings and update them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Bigfishgames Syndicate
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bigfishgames Syndicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 13, 2026Starfish Review Generation & Marketing for: Unauthorized modification of data that can lead to privilege escalationCVE-2025-15157 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Starfish Review Generation & Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'srm_restore_options_defaults' function in all versions up to, and including, 3.1.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Starfish Review Generation & Marketing for
- Affected
- up to 3.1.19
- What to do
- Affects up to 3.1.19. Update Starfish Review Generation & Marketing for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 23, 2025Fish House: Deserialization of Untrusted DataCVE-2025-31631 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House fish-house allows Object Injection.This issue affects Fish House: from n/a through <= 1.2.7.
- Product
- Fish House
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Fish House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Starfish Review Generation & Marketing: Missing AuthorizationCVE-2025-39533 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Starfish Reviews Starfish Review Generation & Marketing starfish-reviews allows Privilege Escalation.This issue affects Starfish Review Generation & Marketing: from n/a through <= 3.1.19.
- Product
- Starfish Review Generation & Marketing
- Affected
- up to 3.1.19
- What to do
- Affects up to 3.1.19. Update Starfish Review Generation & Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate: Reflected Cross-Site ScriptingCVE-2024-9237 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2022Rich Reviews by Starfish plugin <= 1.9.14 at: Cross-Site Request Forgery (CSRF)CVE-2021-36861 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete reviews.
- Product
- Rich Reviews by Starfish plugin <= 1.9.14 at
- Affected
- up to 1.9.14
- What to do
- Affects up to 1.9.14. Update Rich Reviews by Starfish plugin <= 1.9.14 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 27, 2021Rich Reviews by Starfish: Does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statementCVE-2021-24753 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
- Product
- Rich Reviews by Starfish
- Fixed in
- 1.9.6
- What to do
- Update Rich Reviews by Starfish to 1.9.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 24, 2009ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for: SQL injectionCVE-2008-7040 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for Wordpress allows remote attackers to execute arbitrary SQL commands via the u parameter. NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
- Product
- ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for
- What to do
- Update ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for to the newest version.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.