Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
May 13, 2026WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scriCVE-2020-37174 · WordPress plugins & themes · reported by VulnCheckMedium 4.8
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering XSS payloads in design tab textfields. Attackers can inject JavaScript code through fields like 'Text for block toggle' and 'Custom front css styles' that executes on frontend pages when saved, affecting all site visitors.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordproducts-filter.comwordpress.org
Mar 24, 2026Out-of-bounds Read vulnerability in fabiangreffrath woof.This issue affects woof: before woof_15.3.0.CVE-2026-4750 · Other software · fabiangreffrath · reported by cve_disclosure@tech.gov.sgCritical 9.1
Out-of-bounds Read vulnerability in fabiangreffrath woof.This issue affects woof: before woof_15.3.0.
- Product
- woof
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels): Stored Cross-Site ScriptingCVE-2025-8607 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block's attributes in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 8, 2025SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels): Stored Cross-Site ScriptingCVE-2024-13675 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Icon List" Block in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 20, 2024SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38684 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in FunnelKit SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) allows Stored XSS.This issue affects SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels): from n/a through 1.4.1.
- Product
- SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection')CVE-2024-32680 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUS HUSKY – Products Filter for WooCommerce (formerly WOOF) allows Using Malicious Files, Code Inclusion.This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.2.
- Product
- HUSKY – Products Filter for WooCommerce (formerly WOOF)
- Affected
- up to 1.3.5.2
- What to do
- Affects up to 1.3.5.2. Update HUSKY – Products Filter for WooCommerce (formerly WOOF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 29, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Cross-Site Request Forgery (CSRF)CVE-2024-30462 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.1.
- Product
- HUSKY – Products Filter for WooCommerce (formerly WOOF)
- Affected
- up to 1.3.5.1
- What to do
- Affects up to 1.3.5.1. Update HUSKY – Products Filter for WooCommerce (formerly WOOF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 15, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Cross-Site Request Forgery (CSRF)CVE-2023-50861 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.
- Product
- HUSKY – Products Filter for WooCommerce (formerly WOOF)
- Affected
- up to 1.3.4.3
- What to do
- Affects up to 1.3.4.3. Update HUSKY – Products Filter for WooCommerce (formerly WOOF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 5, 2023A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress.CVE-2015-10113 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the file wooframework-tweaks.php. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is 3b57d405149c1a59d1119da6e0bb8212732c9c88. It is recommended to upgrade the affected component. The identifier VDB-230653 was assigned to this vulnerability.
- Product
- WooFramework Tweaks
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WooFramework Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress.CVE-2015-10112 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress. Affected is the function admin_screen_logic of the file wooframework-branding.php. The manipulation of the argument url leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is f12fccd7b5eaf66442346f748c901ef504742f78. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230652.
- Product
- WooFramework Branding
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WooFramework Branding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2022WOOF: Does not sanitise and escape the woof_redraw_elements before outputing back in an admin pageCVE-2021-25085 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- WOOF
- Fixed in
- 1.2.6.3
- What to do
- Update WOOF to 1.2.6.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2018A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode paCVE-2018-8711 · WordPress plugins & themes · reported by MITRECritical 9.8
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.
- Product
- A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF)
- Fixed in
- 2.2.0
- What to do
- Update A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD recordsec-consult.comwordpress.org
Mar 14, 2018A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode pCVE-2018-8710 · WordPress plugins & themes · reported by MITRECritical 9.8
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.
- Product
- A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF)
- Fixed in
- 2.2.0
- What to do
- Update A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) to 2.2.0 or newer.
Full record and what to do →NVD recordsec-consult.comwordpress.org
Jan 10, 2008Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6CVE-2008-0231 · Other software · Tuned Studios · reported by MITREHigh 7.5
Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme webpage templates allow remote attackers to include and execute arbitrary files via ".." sequences in the page parameter. NOTE: this can be leveraged for remote file inclusion when running in some PHP 5 environments.
- Product
- Classic Theme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.