Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Oct 29, 2026TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7.
- Product
- TableOn
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2026File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro: Do not correctly validate the origin of window messages received by the file browser they load on their admin scrCVE-2026-85081 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.
- Product
- File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro
- Fixed in
- 8.0.5
- What to do
- Update File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro to 8.0.5 or newer.
Aug 5, 2026TableOn – WordPress Posts Table Filterable: Blind SQL InjectionCVE-2026-18881 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query — the value is split on `:` and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()`. This makes it possible for unauthenticated attackers to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database (researcher demonstrated extraction of database(), wp_users.user_login, and wp_users.user_pass).
- Product
- TableOn – WordPress Posts Table Filterable
- Affected
- up to 1.0.5.1
- What to do
- Affects up to 1.0.5.1. Update TableOn – WordPress Posts Table Filterable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 6, 2026The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File MCVE-2026-6382 · WordPress plugins & themes · reported by WPScanCritical 9.1
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
- Fixed in
- 1.1.9
- What to do
- Update the plugin to 1.1.9 or newer.
Jul 6, 2026FileOrganizer: Does not validate the file type on several of its file-management operationsCVE-2026-11962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
- Product
- FileOrganizer
- Fixed in
- 1.2.0
- What to do
- Update FileOrganizer to 1.2.0 or newer.
May 27, 2026TableOn: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42755 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 TableOn posts-table-filterable allows Blind SQL Injection.This issue affects TableOn: from n/a through <= 1.0.5.1.
- Product
- TableOn
- Affected
- up to 1.0.5.1
- What to do
- Affects up to 1.0.5.1. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026TableOn – WordPress Posts Table Filterable: Stored Cross-Site ScriptingCVE-2026-3513 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up to and including 1.0.4.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'class', 'help_link', 'popup_title', and 'help_title'. The do_shortcode_button() function extracts these attributes without sanitization and passes them to TABLEON_HELPER::draw_html_item(), which concatenates attribute values into HTML using single quotes without escaping (line 29: $item .= " {$key}='{$value}'"). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TableOn – WordPress Posts Table Filterable
- Affected
- up to 1.0.4.4
- What to do
- Affects up to 1.0.4.4. Update TableOn – WordPress Posts Table Filterable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 5, 2026Coleo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28091 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Coleo coleo allows PHP Local File Inclusion.This issue affects Coleo: from n/a through <= 1.1.7.
- Product
- Coleo
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Coleo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69316 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through <= 1.0.4.2.
- Product
- TableOn
- Affected
- up to 1.0.4.2
- What to do
- Affects up to 1.0.4.2. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025TableOn: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-60244 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RealMag777 TableOn posts-table-filterable allows Code Injection.This issue affects TableOn: from n/a through <= 1.0.5.1.
- Product
- TableOn
- Affected
- up to 1.0.5.1
- What to do
- Affects up to 1.0.5.1. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Kleo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64363 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeventhQueen Kleo kleo allows PHP Local File Inclusion.This issue affects Kleo: from n/a through < 5.5.0.
- Product
- Kleo
- What to do
- Update Kleo to the newest version.
Jun 21, 2025TableOn – WordPress Posts Table Filterable: Stored Cross-Site ScriptingCVE-2025-5143 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TableOn – WordPress Posts Table Filterable
- Affected
- up to 1.0.4.1
- What to do
- Affects up to 1.0.4.1. Update TableOn – WordPress Posts Table Filterable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 16, 2025Chameleon HTML5 Audio Player With/Without Playlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32307 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Chameleon HTML5 Audio Player With/Without Playlist lbg-audio1-html5 allows SQL Injection.This issue affects Chameleon HTML5 Audio Player With/Without Playlist: from n/a through <= 3.5.6.
- Product
- Chameleon HTML5 Audio Player With/Without Playlist
- Affected
- up to 3.5.6
- What to do
- Affects up to 3.5.6. Update Chameleon HTML5 Audio Player With/Without Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 28, 2025Kleo: Missing AuthorizationCVE-2025-39367 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SeventhQueen Kleo kleo.This issue affects Kleo: from n/a through < 5.4.4.
- Product
- Kleo
- What to do
- Update Kleo to the newest version.
Apr 17, 2025TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32592 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Stored XSS.This issue affects TableOn: from n/a through <= 1.0.3.
- Product
- TableOn
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025TableOn: Deserialization of Untrusted DataCVE-2025-32569 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in RealMag777 TableOn posts-table-filterable allows Object Injection.This issue affects TableOn: from n/a through <= 1.0.4.3.
- Product
- TableOn
- Affected
- up to 1.0.4.3
- What to do
- Affects up to 1.0.4.3. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025TableOn: Missing AuthorizationCVE-2025-32218 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RealMag777 TableOn posts-table-filterable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TableOn: from n/a through <= 1.0.5.1.
- Product
- TableOn
- Affected
- up to 1.0.5.1
- What to do
- Affects up to 1.0.5.1. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Kleo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56209 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen Kleo kleo allows Reflected XSS.This issue affects Kleo: from n/a through < 5.4.4.
- Product
- Kleo
- What to do
- Update Kleo to the newest version.
Dec 7, 2024FileOrganizer – Manage WordPress and Website Files: Local JavaScript File InclusionCVE-2024-11010 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the 'default_lang' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server, allowing the execution of any JavaScript code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- FileOrganizer – Manage WordPress and Website Files
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 2, 2024Chameleoni Jobs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52459 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chameleoni Chameleoni Jobs chameleon-jobs allows Reflected XSS.This issue affects Chameleoni Jobs: from n/a through <= 2.5.4.
- Product
- Chameleoni Jobs
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Chameleoni Jobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.complugins.svn.wordpress.org
Nov 9, 2024Leopard - WordPress Offload Media: Unauthorized modification of data that can lead to privilege escalationCVE-2024-10589 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the import_settings() function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Leopard - WordPress Offload Media
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Leopard - WordPress Offload Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Oct 29, 2024FileOrganizer – Manage WordPress and Website Files: Arbitrary file uploadsCVE-2024-7985 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the "fileorganizer_ajax_handler" function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: The FileOrganizer Pro plugin must be installed and active to allow Subscriber+ users to upload files.
- Product
- FileOrganizer – Manage WordPress and Website Files
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 23, 2024Portfolleo: Unrestricted Upload of File with Dangerous TypeCVE-2024-49653 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in james-eggers Portfolleo portfolleo allows Upload a Web Shell to a Web Server.This issue affects Portfolleo: from n/a through <= 1.2.
- Product
- Portfolleo
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Portfolleo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Leopard - WordPress offload media: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.
- Product
- Leopard - WordPress offload media
- Affected
- up to 2.0.36
- What to do
- Affects up to 2.0.36. Update Leopard - WordPress offload media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Leopard - WordPress offload media: Missing AuthorizationCVE-2024-43256 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in nouthemes Leopard - WordPress offload media allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.
- Product
- Leopard - WordPress offload media
- Affected
- up to 2.0.36
- What to do
- Affects up to 2.0.36. Update Leopard - WordPress offload media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2024FileOrganizer – Manage WordPress and Website Files: Sensitive Information ExposureCVE-2024-5599 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
- Product
- FileOrganizer – Manage WordPress and Website Files
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2024FileOrganizer – Manage WordPress and Website Files: Stored Cross-Site ScriptingCVE-2024-2324 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. For the free version, this is limited to administrators. The pro version is also vulnerable and exploitable by administrators, but also offers the functionality to lower level users (as low as subscribers) if enabled.
- Product
- FileOrganizer – Manage WordPress and Website Files
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 29, 2024Jobeleon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-47153 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPJobBoard Jobeleon Theme allows Reflected XSS.This issue affects Jobeleon Theme: from n/a through 1.9.1.
- Product
- Jobeleon
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Jobeleon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Leo Caseiro Custom Options Plus plugin <= 1.8.1 versions.CVE-2023-28420 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Leo Caseiro Custom Options Plus plugin <= 1.8.1 versions.
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 25, 2023FileOrganizer: Does not restrict functionality on multisite instancesCVE-2023-3664 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.
- Product
- FileOrganizer
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update FileOrganizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2021Chameleon CSS: Does not have any CSRF and capability checks in all its AJAX callsCVE-2021-24626 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection
- Product
- Chameleon CSS
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Chameleon CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.