Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Oct 13, 2026An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php componentCVE-2026-37107 · Other software · reported by MITRECritical 9.8
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 3, 2026A weakness has been identified in danpros HTMLy up to 3.1.1.CVE-2026-18646 · Other software · danpros · reported by VulDBMedium 5.5
A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HTMLy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026A security flaw has been discovered in danpros HTMLy up to 3.1.1.CVE-2026-18645 · Other software · danpros · reported by VulDBLow 2.1
A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HTMLy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026A vulnerability was identified in danpros HTMLy up to 3.1.1.CVE-2026-18644 · Other software · danpros · reported by VulDBLow 2.1
A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HTMLy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality.CVE-2026-57940 · Other software · danpros · reported by MITRELow 2.1
HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a request to the attacker-controlled target.
- Product
- HTMLy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying direCVE-2026-45233 · Other software · danpros · reported by VulnCheckHigh 7.2
HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement to cause unintended relocation of any file writable by the web server process to an attacker-specified draft location.
- Product
- htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvulncheck.com
Apr 28, 2026Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint.CVE-2026-38949 · Other software · reported by MITREHigh 8.9
Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint. The application fails to properly sanitize user input, allowing injection of arbitrary code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application.CVE-2025-56154 · Other software · Htmly · reported by MITREMedium 6.1
htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitized before being reflected in the HTML response, allowing attackers to inject arbitrary JavaScript payloads.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 20, 2025A security vulnerability has been detected in htmly up to 3.1.0.CVE-2025-10758 · Other software · Htmly · reported by VulDBLow 1.9
A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the component Custom Field Handler. Such manipulation of the argument label leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.php.CVE-2024-34191 · Other software · htmly · reported by MITREMedium 6.5
htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.php. This vulnerability allows attackers to delete arbitrary files via a crafted request.
- Product
- htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchmod744.super.sitechmod744.super.site
Apr 17, 2024A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into CVE-2024-30953 · Other software · htmly · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link Name parameter of Menu Editor module.
- Product
- htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2022Directory Traversal vulnerability in htmly before 2.8.1 allows remote attackers to perform arbitrary file deletions via modified file parameter.CVE-2021-33354 · Other software · Htmly · reported by MITREHigh 8.1
Directory Traversal vulnerability in htmly before 2.8.1 allows remote attackers to perform arbitrary file deletions via modified file parameter.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2022htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php.CVE-2021-40285 · Other software · Htmly · reported by MITREHigh 8.1
htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.CVE-2021-42946 · Other software · Htmly · reported by MITREMedium 4.8
A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.CVE-2021-42867 · Other software · Htmly · reported by MITREMedium 4.8
A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2022A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module.CVE-2022-1087 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module. The manipulation of the field Title with script tags leads to persistent cross site scripting. The attack may be initiated remotely and requires an authentication. A simple POC has been disclosed to the public and may be used.
- Product
- htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of aCVE-2022-25022 · Other software · Htmly · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of a blog post.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcvedetails.com
Aug 3, 2021The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability.CVE-2021-36703 · Other software · Htmly · reported by MITREMedium 6.1
The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website name.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerabilityCVE-2021-36702 · Other software · Htmly · reported by MITREMedium 6.1
The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files.CVE-2021-36701 · Other software · Htmly · reported by MITRECritical 9.1
In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. The vulnerability may allow a remote attacker to delete arbitrary know files on the host.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server CVE-2020-23766 · Other software · Htmly · reported by MITREMedium 6.5
An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server should they gain Administrator privileges.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2021htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.CVE-2021-30637 · Other software · Htmly · reported by MITREMedium 5.4
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 8, 2019Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) destination parametCVE-2019-8349 · Other software · Htmly · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) destination parameter to delete feature; the (2) destination parameter to edit feature; (3) content parameter in the profile feature.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.