Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Mar 10, 2026If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automaticallCVE-2025-70129 · Other software · Pluxml · reported by MITREMedium 5.3
If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including "capcha-letter", "capcha-word" and "capcha-token" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier.CVE-2025-70128 · Other software · Pluxml · reported by MITREMedium 6.1
A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to properly sanitize or validate user-supplied input in the "link" field of a comment. An attacker can inject arbitrary JavaScript code using a <script> element. The injected payload is stored in the database and subsequently rendered in the Administration panel's "Comments" section when administrators review submitted comments. Importantly, the malicious script is not reflected in the public-facing comments interface, but only within the backend administration view. Alternatively, users of Administrator, Moderator, Manager roles can also directly input crafted payloads into existing comments. This makes the vulnerability a persistent XSS issue targeting administrative users. This affects /core/admin/comments.php, while CVE-2022-24585 affects /core/admin/comment.php, a uniquely distinct vulnerability.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026PluXml CMS allows a user's session identifier to be set before authentication.CVE-2026-24352 · Other software · PluXml · reported by cvd@cert.plMedium 4.8
PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
- Product
- PluXml CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality.CVE-2026-24351 · Other software · PluXml · reported by cvd@cert.plMedium 5.1
PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
- Product
- PluXml CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026PluXml CMS is vulnerable to Stored XSS in file uploading functionality.CVE-2026-24350 · Other software · PluXml · reported by cvd@cert.plMedium 5.1
PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malicious payload, which will be executed when a victim clicks the link associated with the uploaded image. In version 5.9.0-rc7 clicking the link associated with the uploaded image doesn't execute malicious code but directly accessing the file will still execute the embedded payload. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
- Product
- PluXml CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026A vulnerability was determined in PluXml up to 5.8.22.CVE-2025-15438 · Other software · Pluxml · reported by VulDBLow 2
A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Dec 22, 2025Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a themCVE-2025-67436 · Other software · Pluxml · reported by MITREMedium 6.5
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directoryCVE-2025-57567 · Other software · reported by MITRECritical 9.1
A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel, enabling execution of system commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute aCVE-2024-48138 · Other software · pluxml · reported by MITRECritical 9.8
A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template.
- Product
- pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature.CVE-2024-22636 · Other software · Pluxml · reported by MITREHigh 8.8
PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail patCVE-2022-25020 · Other software · Pluxml · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcvedetails.com
Feb 28, 2022Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.CVE-2022-25018 · Other software · Pluxml · reported by MITREHigh 8.8
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HCVE-2022-24587 · Other software · Pluxml · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts orCVE-2022-24585 · Other software · Pluxml · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scriptsCVE-2022-24586 · Other software · Pluxml · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.CVE-2021-38603 · Other software · Pluxml · reported by MITREMedium 4.8
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 12, 2021PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.CVE-2021-38602 · Other software · Pluxml · reported by MITREMedium 4.8
PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment.CVE-2020-18185 · Other software · Pluxml · reported by MITRECritical 9.8
class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020In PluxXml V5.7,the theme edit function /PluXml/core/admin/parametres_edittpl.php allows remote attackers to execute arbitrary PHP code by placing this code intCVE-2020-18184 · Other software · Pluxxml · reported by MITREHigh 7.2
In PluxXml V5.7,the theme edit function /PluXml/core/admin/parametres_edittpl.php allows remote attackers to execute arbitrary PHP code by placing this code into a template.
- Product
- Pluxxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2017PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges.CVE-2017-1001001 · Other software · PluXml · reported by 46fe6300-5254-4a98-9594-a9567bec8179Medium 5.4
PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges.
- Product
- PluXml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2012Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file CVE-2012-4675 · Other software · Pluxml · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comtelechargements.pluxml.org
Aug 26, 2012PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.CVE-2012-4674 · Other software · Pluxml · reported by MITREMedium 5
PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtelechargements.pluxml.orgpluxml.org
Aug 26, 2012Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (eCVE-2012-2227 · Other software · Pluxml · reported by MITREHigh 7.5
Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Jul 3, 2007Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.CVE-2007-3542 · Other software · Pluxml · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgexchange.xforce.ibmcloud.com
Jun 26, 2007Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code via a .jpg filename.CVE-2007-3432 · Other software · Pluxml · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code via a .jpg filename.
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.