Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

60 results · page 1 of 2

Oct 6, 2026Autoship Cloud for WooCommerce Subscription Products: Missing AuthorizationCVE-2026-39762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.
Product
Autoship Cloud for WooCommerce Subscription Products
Affected
up to 2.17.1
What to do
Affects up to 2.17.1. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 16, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Unauthenticated Arbitrary File OverwriteCVE-2026-78088 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite known files which may lead to remote code execution when certain preconditions are met.
Product
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Affected
up to 32.0.1
What to do
Affects up to 32.0.1. Update Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 15, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Second-Order SQL InjectionCVE-2026-16586 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Affected
up to 30.0.7
What to do
Affects up to 30.0.7. Update Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Embed Google Photos album: Does not escape a shortcode attribute value before outputting it inside an HTML attributeCVE-2026-14290 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.
Product
Embed Google Photos album
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Embed Google Photos album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026Gallery for Google Photos: Does not properly restrict access to the stored third-party OAuth credentials of the connected accountCVE-2026-15236 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.
Product
Gallery for Google Photos
Fixed in
1.2.1
What to do
Update Gallery for Google Photos to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Lightbox with PhotoSwipe: Does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browserCVE-2026-14833 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.
Product
Lightbox with PhotoSwipe
Fixed in
5.9.0
What to do
Update Lightbox with PhotoSwipe to 5.9.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026PhotoSwipe: Uses the title attribute of author-supplied link markupCVE-2026-13605 · WordPress plugins & themes · reported by WPScanMedium 6.8
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link.
Product
PhotoSwipe
Affected
up to 4.1.1.1
What to do
Affects up to 4.1.1.1. Update PhotoSwipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Privilege EscalationCVE-2026-12165 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the `RegistryUserRole` parameter. This is due to the plugin's admin menu being registered at the `edit_posts` capability level — granting Contributor-level users access to the plugin's admin pages and a valid `cg_admin` nonce — while the option-saving handler in `change-options-and-sizes.php` performs no `current_user_can()` capability check beyond `check_admin_referer('cg_admin')`, and the `RegistryUserRole` value is processed only through `sanitize_text_field()` and `htmlentities()` without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's stored `RegistryUserRole` option with `administrator`, which the `cg_create_wp_user_from_google_user` function then reads back from the `contest_gal1ery_registry_and_login_options` database table without any allowlist validation and passes directly to `wp_update_user()`, effectively promoting a newly registered Google sign-in account to Administrat
Product
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Affected
up to 30.0.2
What to do
Affects up to 30.0.2. Update Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 1, 2026WP AutoSuggest 0.24 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code tCVE-2018-25434 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WP AutoSuggest 0.24 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wpas_keys parameter. Attackers can send GET requests to autosuggest.php with crafted wpas_keys values to extract sensitive database information from WordPress posts and other tables.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record kaimi.io wordpress.org
May 25, 2026Autoship Cloud for WooCommerce Subscription Products: Missing AuthorizationCVE-2026-24527 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.14.0.
Product
Autoship Cloud for WooCommerce Subscription Products
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 22, 2026Easy Social Photos Gallery: Stored Cross-Site ScriptingCVE-2026-4085 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Social Photos Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper_class' shortcode attribute of the 'my-instagram-feed' shortcode in all versions up to, and including, 3.1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. Specifically, the plugin uses sanitize_text_field() instead of esc_attr() when outputting the 'wrapper_class' attribute inside a double-quoted HTML class attribute. Since sanitize_text_field() does not encode double quotes, an attacker can break out of the class attribute and inject arbitrary HTML event handlers. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Social Photos Gallery
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Easy Social Photos Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 2, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Blind SQL InjectionCVE-2026-3180 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability's ’cgLostPasswordEmail’ parameter was patched in version 28.1.4, and the ’cgl_mail’ parameter was patched in version 28.1.5.
Product
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Affected
up to 28.1.4
What to do
Affects up to 28.1.4. Update Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Autoshare for Twitter: Missing AuthorizationCVE-2026-25311 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoshare for Twitter: from n/a through <= 2.3.1.
Product
Autoshare for Twitter
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Autoshare for Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2026PhotoStack Gallery: SQL InjectionCVE-2026-2024 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The PhotoStack Gallery plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 0.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
PhotoStack Gallery
Affected
up to 0.4.1
What to do
Affects up to 0.4.1. Update PhotoStack Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026Protección de datos – RGPD: Missing AuthorizationCVE-2026-24539 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ABCdatos Protección de datos – RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protección de datos – RGPD: from n/a through <= 0.68.
Product
Protección de datos – RGPD
Affected
up to 0.68
What to do
Affects up to 0.68. Update Protección de datos – RGPD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 10, 2025Live Photos on: Stored Cross-Site ScriptingCVE-2025-12651 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user accesses an injected page.
Product
Live Photos on
Affected
up to 0.1
What to do
Affects up to 0.1. Update Live Photos on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 26, 2025Photospace Responsive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62899 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in THRIVE - Web Design Gold Coast Photospace Responsive photospace-responsive allows Stored XSS.This issue affects Photospace Responsive: from n/a through <= 2.2.0.
Product
Photospace Responsive
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Photospace Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Easy Social Feed – Social Photos Gallery – Post Feed – Like Box: Stored Cross-Site ScriptingCVE-2025-6067 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` and `data-linktext` parameters in all versions up to, and including, 6.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Affected
up to 6.6.7
What to do
Affects up to 6.6.7. Update Easy Social Feed – Social Photos Gallery – Post Feed – Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI pluginCVE-2025-7725 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment feature in all versions up to, and including, 26.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.1.0
What to do
Affects up to 26.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 11, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI pluginCVE-2025-6716 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'upload[1][title]' parameter in all versions up to, and including, 26.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.0.8
What to do
Affects up to 26.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2025Simple Google Photos Grid: Server-Side Request Forgery (SSRF)CVE-2025-46503 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in josheli Simple Google Photos Grid simple-google-photos-grid allows Server Side Request Forgery.This issue affects Simple Google Photos Grid: from n/a through <= 1.5.
Product
Simple Google Photos Grid
Affected
up to 1.5
What to do
Affects up to 1.5. Update Simple Google Photos Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025Flickr Photostream: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31467 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miro.mannino Flickr Photostream flickr-photostream allows Reflected XSS.This issue affects Flickr Photostream: from n/a through <= 3.1.8.
Product
Flickr Photostream
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Flickr Photostream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025PhotoShelter for Photographers Blog Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31766 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PhotoShelter PhotoShelter for Photographers Blog Feed Plugin photoshelter-official-plugin allows Stored XSS.This issue affects PhotoShelter for Photographers Blog Feed Plugin: from n/a through <= 1.5.7.
Product
PhotoShelter for Photographers Blog Feed
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update PhotoShelter for Photographers Blog Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Já-Já Pagamentos for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51624 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jajapagamentos Já-Já Pagamentos for WooCommerce wc-ja-ja-pagamentos-multicaixa-express allows Reflected XSS.This issue affects Já-Já Pagamentos for WooCommerce: from n/a through <= 1.3.0.
Product
Já-Já Pagamentos for WooCommerce
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Já-Já Pagamentos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Hacklog Remote Image Autosave: Cross-Site Request Forgery (CSRF)CVE-2025-30576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery.This issue affects Hacklog Remote Image Autosave: from n/a through <= 2.1.0.
Product
Hacklog Remote Image Autosave
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Hacklog Remote Image Autosave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Dreamstime Stock Photos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25090 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamstime Dreamstime Stock Photos dreamstime-stock-photos allows Reflected XSS.This issue affects Dreamstime Stock Photos: from n/a through <= 4.1.
Product
Dreamstime Stock Photos
Affected
up to 4.1
What to do
Affects up to 4.1. Update Dreamstime Stock Photos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 28, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WorCVE-2025-1513 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Name and Comment field when commenting on photo gallery entries in all versions up to, and including, 26.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.0.0.1
What to do
Affects up to 26.0.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 25, 2025Autoship Cloud for WooCommerce Subscription Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26878 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows DOM-Based XSS.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through <= 2.8.0.1.
Product
Autoship Cloud for WooCommerce Subscription Products
Affected
up to 2.8.0.1
What to do
Affects up to 2.8.0.1. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 21, 2025Autoship Cloud for WooCommerce Subscription Products: Stored Cross-Site ScriptingCVE-2024-13461 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Autoship Cloud for WooCommerce Subscription Products
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2024Onlywire Multi Autosubmitter: Cross-Site Request Forgery (CSRF)CVE-2024-54435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Onlywire Multi Autosubmitter onlywire-multi-autosubmitter allows Stored XSS.This issue affects Onlywire Multi Autosubmitter: from n/a through <= 1.2.4.
Product
Onlywire Multi Autosubmitter
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Onlywire Multi Autosubmitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 5, 2024The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is CVE-2024-10687 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is vulnerable to time-based SQL Injection via the $collectedIds parameter in all versions up to, and including, 24.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected
up to 24.0.3
What to do
Affects up to 24.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024Free Stock Photos Foter: Deserialization of Untrusted DataCVE-2024-49227 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through <= 1.5.4.
Product
Free Stock Photos Foter
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Free Stock Photos Foter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 28, 2024Simple Photoswipe: Does not have authorisation checkCVE-2024-5570 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them
Product
Simple Photoswipe
Affected
up to 0.1
What to do
Affects up to 0.1. Update Simple Photoswipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 26, 2024Simple Photoswipe: Does not sanitise and escape some of its settingsCVE-2024-5473 · WordPress plugins & themes · reported by WPScanMedium 4
The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple Photoswipe
Affected
up to 0.1
What to do
Affects up to 0.1. Update Simple Photoswipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2024Pexels: Free Stock Photos: Arbitrary file uploadsCVE-2024-6132 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pexels: Free Stock Photos plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'pexels_fsp_images_options_validate' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Pexels: Free Stock Photos
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Pexels: Free Stock Photos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2024Embed Google Photos album: Server-Side Request Forgery (SSRF)CVE-2024-32775 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9.
Product
Embed Google Photos album
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Embed Google Photos album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Easy Social Feed – Social Photos Gallery – Post Feed – Like Box: Stored Cross-Site ScriptingCVE-2024-1278 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'efb_likebox' shortcode in all versions up to, and including, 6.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Affected
up to 6.5.4
What to do
Affects up to 6.5.4. Update Easy Social Feed – Social Photos Gallery – Post Feed – Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Easy Social Feed – Social Photos Gallery – Post Feed – Like Box: Cross-Site Request ForgeryCVE-2024-1214 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the save_groups_list function. This makes it possible for unauthenticated attackers to disconnect a site's facebook or instagram page/group connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Affected
up to 6.5.4
What to do
Affects up to 6.5.4. Update Easy Social Feed – Social Photos Gallery – Post Feed – Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Easy Social Feed – Social Photos Gallery – Post Feed – Like Box: Cross-Site Request ForgeryCVE-2024-1213 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the esf_insta_save_access_token and efbl_save_facebook_access_token functions. This makes it possible for unauthenticated attackers to connect their facebook and instagram pages to the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Affected
up to 6.5.4
What to do
Affects up to 6.5.4. Update Easy Social Feed – Social Photos Gallery – Post Feed – Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2024Photos and Files Contest Gallery: Does not sanitize and escape some parametersCVE-2024-1487 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users with a role as low as author to perform Cross-Site Scripting attacks.
Product
Photos and Files Contest Gallery
Fixed in
21.3.1
What to do
Update Photos and Files Contest Gallery to 21.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 23, 2024Pexels: Free Stock Photos: Server-Side Request Forgery (SSRF)CVE-2024-25915 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Raaj Trambadia Pexels: Free Stock Photos.This issue affects Pexels: Free Stock Photos: from n/a through 1.2.2.
Product
Pexels: Free Stock Photos
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Pexels: Free Stock Photos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for: Cross-Site Request Forgery (CSRF)CVE-2024-24887 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress.This issue affects Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress: from n/a through 21.2.8.4.
Product
Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for
Affected
up to 21.2.8.4
What to do
Affects up to 21.2.8.4. Update Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Google Photos Gallery with Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51373 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ian Kennerley Google Photos Gallery with Shortcodes allows Reflected XSS.This issue affects Google Photos Gallery with Shortcodes: from n/a through 4.0.2.
Product
Google Photos Gallery with Shortcodes
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Google Photos Gallery with Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Photos and Files Contest Gallery: Does not sanitise and escape some parametersCVE-2023-5307 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.
Product
Photos and Files Contest Gallery
Fixed in
21.2.8.1
What to do
Update Photos and Files Contest Gallery to 21.2.8.1 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Oct 20, 2023Photospace Responsive: Stored Cross-Site ScriptingCVE-2023-4271 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Photospace Responsive
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Photospace Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 6, 2023A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress.CVE-2015-10126 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as 503d9ee2482d27c065f78d9546f076a406189908. It is recommended to upgrade the affected component. VDB-241318 is the identifier assigned to this vulnerability.
Fixed in
1.1.0
What to do
Update the plugin to 1.1.0 or newer.
Full record and what to do →NVD record github.com vuldb.com
Jul 18, 2023A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic.CVE-2021-4428 · WordPress plugins & themes · reported by VulDBLow 2.7
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.
Product
what3words Autosuggest
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update what3words Autosuggest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Nov 29, 2022Photospace Gallery: Stored Cross-Site ScriptingCVE-2022-3991 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photospace Gallery
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Photospace Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 28, 2022Fancier Author Box by ThematoSoup: Does not sanitise and escape some of its settingsCVE-2022-3833 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Fancier Author Box by ThematoSoup
Affected
up to 1.4
What to do
Affects up to 1.4. Update Fancier Author Box by ThematoSoup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 12, 2022Dean Oakley's Photospace Gallery plugin <= 2.3.5 at: Broken Access ControlCVE-2022-38135 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.
Product
Dean Oakley's Photospace Gallery plugin <= 2.3.5 at
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Dean Oakley's Photospace Gallery plugin <= 2.3.5 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.