Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Jun 15, 2026Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.CVE-2026-39530 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.
- Affected
- up to 4.6.5
- What to do
- Affects up to 4.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Petitioner: Missing AuthorizationCVE-2026-32514 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anton Voytenko Petitioner petitioner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Petitioner: from n/a through <= 0.7.3.
- Product
- Petitioner
- Affected
- up to 0.7.3
- What to do
- Affects up to 0.7.3. Update Petitioner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Competition Form: Does not have CSRF check in placeCVE-2024-12750 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Competition Form
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Competition Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Photo Contest | Competition | Video Contest: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13822 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Photo Contest | Competition | Video Contest
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Photo Contest | Competition | Video Contest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2025Competition Form: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12749 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Competition Form
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Competition Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025SpeakOut! Email Petitions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22309 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RopeSwingHld SpeakOut! Email Petitions speakout allows DOM-Based XSS.This issue affects SpeakOut! Email Petitions: from n/a through <= 4.4.2.
- Product
- SpeakOut! Email Petitions
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update SpeakOut! Email Petitions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025SweepWidget Contests, Giveaways, Photo Contests, Competitions: Stored Cross-Site ScriptingCVE-2024-11756 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sweepwidget' shortcode in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SweepWidget Contests, Giveaways, Photo Contests, Competitions
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update SweepWidget Contests, Giveaways, Photo Contests, Competitions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2023CBX Petition for: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4383 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- CBX Petition for
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update CBX Petition for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022SpeakOut! Email Petitions: Does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX actionCVE-2022-0846 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- SpeakOut! Email Petitions
- Fixed in
- 2.14.15.1
- What to do
- Update SpeakOut! Email Petitions to 2.14.15.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.