Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,714entries in the database

18 results

Jun 26, 2026CodePeople Post Map for Google Maps: Stored Cross-Site ScriptingCVE-2026-13335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CodePeople Post Map for Google Maps
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update CodePeople Post Map for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2025Contact Us page - Contact people LITE: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28967 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Truman Contact Us page - Contact people LITE contact-us-page-contact-people allows SQL Injection.This issue affects Contact Us page - Contact people LITE: from n/a through <= 3.7.4.
Product
Contact Us page - Contact people LITE
Affected
up to 3.7.4
What to do
Affects up to 3.7.4. Update Contact Us page - Contact people LITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 12, 2025Contact Us Page – Contact People: Stored Cross-Site ScriptingCVE-2025-5123 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 3.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Us Page – Contact People
Affected
up to 3.7.4
What to do
Affects up to 3.7.4. Update Contact Us Page – Contact People to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 15, 2025PeoplePond: Does not have CSRF check in some placesCVE-2024-8085 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
PeoplePond
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update PeoplePond to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2025People Lists: Missing AuthorizationCVE-2025-24691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ctltwp People Lists people-lists allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects People Lists: from n/a through <= 1.3.10.
Product
People Lists
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update People Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Quran Phrases About Most People Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeshanb Quran Phrases About Most People Shortcodes quran-phrases-about-most-people-shortcodes allows DOM-Based XSS.This issue affects Quran Phrases About Most People Shortcodes: from n/a through <= 1.4.
Product
Quran Phrases About Most People Shortcodes
Affected
up to 1.4
What to do
Affects up to 1.4. Update Quran Phrases About Most People Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024MagePeople Team Taxi Booking Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43986 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagePeople Team Taxi Booking Manager for WooCommerce allows Stored XSS.This issue affects Taxi Booking Manager for WooCommerce: through 1.0.9.
Product
MagePeople Team Taxi Booking Manager for WooCommerce
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update MagePeople Team Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions.CVE-2023-30496 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions.
Fixed in
5.2.6
What to do
Update the plugin to 5.2.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Blocks plugin <= 1.0.20 versions.CVE-2023-41732 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Blocks plugin <= 1.0.20 versions.
Fixed in
1.0.21
What to do
Update the plugin to 1.0.21 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 27, 2023ERP: Does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statementCVE-2023-2744 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
ERP
Fixed in
1.12.4
What to do
Update ERP to 1.12.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.CVE-2022-47164 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6: Auth. (admin+) Stored Cross-site Scripting (XSS)CVE-2023-28422 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.
Product
MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6
Fixed in
3.8.7
What to do
Update MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6 to 3.8.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 4, 2023A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical.CVE-2014-125091 · WordPress plugins & themes · reported by VulDBMedium 4.7
A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 6d7168cbf12d1c183bacc5cd5678f6f5b0d518d2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222268.
Affected
1.0.1 to 1.0.1
What to do
Affects 1.0.1 to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0.CVE-2023-23973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0.
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2022CP Image Store with Slideshow: Does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embedCVE-2022-1692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
Product
CP Image Store with Slideshow
Fixed in
1.0.68
What to do
Update CP Image Store with Slideshow to 1.0.68 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Sep 9, 2021WP Academic People List: Reflected Cross-Site ScriptingCVE-2021-38316 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1.
Product
WP Academic People List
Affected
up to 0.4.1
What to do
Affects up to 0.4.1. Update WP Academic People List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2020The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.CVE-2020-14092 · WordPress plugins & themes · reported by MITRECritical 9.8
The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.
Product
CodePeople Payment Form for PayPal Pro
Fixed in
1.1.65
What to do
Update CodePeople Payment Form for PayPal Pro to 1.1.65 or newer.
Full record and what to do →NVD record wordpress.dwbooster.com wordpress.org
Feb 20, 2008wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for: SQL injectionCVE-2008-0845 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the person parameter.
Product
wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for
What to do
Update wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for to the newest version.
Full record and what to do →NVD record securityreason.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.