Updated 35 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,094 results · page 11 of 22

Apr 23, 2025WordPress Simple Shopping Cart: Sensitive Information ExposureCVE-2025-3529 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.
Product
WordPress Simple Shopping Cart
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 22, 2025Memberpress: Sensitive Information ExposureCVE-2024-11299 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Memberpress
Affected
up to 1.11.37
What to do
Affects up to 1.11.37. Update Memberpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record memberpress.com wordfence.com
Apr 17, 2025wpLike2Get: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39439 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Markus Drubba wpLike2Get wplike2get allows Retrieve Embedded Sensitive Data.This issue affects wpLike2Get: from n/a through <= 1.2.9.
Product
wpLike2Get
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update wpLike2Get to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Essential Addons for Elementor: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Retrieve Embedded Sensitive Data.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.
Product
Essential Addons for Elementor
Affected
up to 6.1.9
What to do
Affects up to 6.1.9. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Mediavine Control Panel: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39556 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mediavine Mediavine Control Panel mediavine-control-panel allows Retrieve Embedded Sensitive Data.This issue affects Mediavine Control Panel: from n/a through <= 2.10.6.
Product
Mediavine Control Panel
Affected
up to 2.10.6
What to do
Affects up to 2.10.6. Update Mediavine Control Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025WP STAGING Pro WordPress Backup: Information ExposureCVE-2025-3104 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plugins.
Product
WP STAGING Pro WordPress Backup
Affected
up to 6.1.2
What to do
Affects up to 6.1.2. Update WP STAGING Pro WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wp-staging.com wordfence.com
Apr 15, 2025Macro Calculator with Admin Email Optin & Data: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26730 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue affects Macro Calculator with Admin Email Optin & Data: from n/a through 1.0.
Product
Macro Calculator with Admin Email Optin & Data
Affected
up to 1.0
What to do
Affects up to 1.0. Update Macro Calculator with Admin Email Optin & Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Developer Toolbar: Sensitive Information ExposureCVE-2025-2881 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
Product
Developer Toolbar
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Developer Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 11, 2025Cart66 Cloud: Sensitive Information ExposureCVE-2025-2841 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
Product
Cart66 Cloud
Affected
up to 2.3.7
What to do
Affects up to 2.3.7. Update Cart66 Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 10, 2025Ai Image Alt Text Generator for WP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32228 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Retrieve Embedded Sensitive Data.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.9.
Product
Ai Image Alt Text Generator for WP
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025SureTriggers: All-in-One Automation Platform: An authentication bypass leading to administrative account creationCVE-2025-3102 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
Product
SureTriggers: All-in-One Automation Platform
Affected
up to 1.0.78
What to do
Affects up to 1.0.78. Update SureTriggers: All-in-One Automation Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2025Squeeze: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31003 · WordPress plugins & themes · reported by PatchstackLow 2.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitive Data.This issue affects Squeeze: from n/a through <= 1.6.
Product
Squeeze
Affected
up to 1.6
What to do
Affects up to 1.6. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2025m1.DownloadList: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32164 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows Retrieve Embedded Sensitive Data.This issue affects m1.DownloadList: from n/a through <= 0.24.
Product
m1.DownloadList
Affected
up to 0.24
What to do
Affects up to 0.24. Update m1.DownloadList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2025Accept SagePay Payments Using Contact Form 7: Sensitive Information ExposureCVE-2025-2883 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
Product
Accept SagePay Payments Using Contact Form 7
Affected
up to 2.0
What to do
Affects up to 2.0. Update Accept SagePay Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2025GreenPay(tm) by Green.Money: Sensitive Information ExposureCVE-2025-2882 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GreenPay(tm) by Green.Money plugin for WordPress is vulnerable to Sensitive Information Exposure in versions between 3.0.0 and 3.0.9 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
Product
GreenPay(tm) by Green.Money
What to do
Update GreenPay(tm) by Green.Money to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2025Melhor Envio: Sensitive Information ExposureCVE-2024-13820 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, which uses a hardcoded hash. This makes it possible for unauthenticated attackers to extract sensitive data including environment information, plugin tokens, shipping configurations, and limited vendor information.
Product
Melhor Envio
Affected
up to 2.15.11
What to do
Affects up to 2.15.11. Update Melhor Envio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Apr 4, 2025KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base: Sensitive Information ExposureCVE-2024-13604 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
Product
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 4, 20251 Click WordPress Migration: Exposure of Sensitive System Information Due to Uncleared Debug InformationCVE-2025-32257 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allows Retrieve Embedded Sensitive Data.This issue affects 1 Click WordPress Migration: from n/a through <= 2.5.7.
Product
1 Click WordPress Migration
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update 1 Click WordPress Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025StaffList: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32255 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ERA404 StaffList stafflist allows Retrieve Embedded Sensitive Data.This issue affects StaffList: from n/a through <= 3.2.7.
Product
StaffList
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update StaffList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Jetpack Feedback Exporter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32251 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in J. Tyler Wiest Jetpack Feedback Exporter jetpack-feedback-exporter allows Retrieve Embedded Sensitive Data.This issue affects Jetpack Feedback Exporter: from n/a through <= 1.23.
Product
Jetpack Feedback Exporter
Affected
up to 1.23
What to do
Affects up to 1.23. Update Jetpack Feedback Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025ACF City Selector: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31832 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beee ACF City Selector acf-city-selector allows Retrieve Embedded Sensitive Data.This issue affects ACF City Selector: from n/a through <= 1.17.0.
Product
ACF City Selector
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update ACF City Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Our Team Members: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-30802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPBean Our Team Members our-team-members.This issue affects Our Team Members: from n/a through <= 2.2.
Product
Our Team Members
Affected
up to 2.2
What to do
Affects up to 2.2. Update Our Team Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Awesome Support – WordPress HelpDesk & Support: Sensitive Information ExposureCVE-2024-13567 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 6.3.1.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 29, 2025DAP to Autoresponders Email Syncing: Sensitive Information ExposureCVE-2025-2840 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
Product
DAP to Autoresponders Email Syncing
Affected
up to 1.0
What to do
Affects up to 1.0. Update DAP to Autoresponders Email Syncing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 28, 2025Booking for Appointments and Events Calendar – Amelia: Full Path DisclosureCVE-2025-2578 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Sensitive Information ExposureCVE-2025-2228 · WordPress plugins & themes · reported by WordfenceMedium 5.7
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.8 the 'register_user' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Edit Login | Registration Form widget, as long as that user opens the email notification for successful registration.
Product
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Sensitive Information ExposureCVE-2025-2252 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the edd_ajax_get_download_title() function. This makes it possible for unauthenticated attackers to extract private post titles of downloads. The impact here is minimal.
Product
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Affected
up to 3.3.6.1
What to do
Affects up to 3.3.6.1. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025GiveWP – Donation Plugin and Fundraising Platform: Sensitive Information ExposureCVE-2025-2331 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.22.1
What to do
Affects up to 3.22.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025Civi - Job Board & Freelance Marketplace: Sensitive Information ExposureCVE-2024-13773 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive data including LinkedIn client and secret keys.
Product
Civi - Job Board & Freelance Marketplace
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Civi - Job Board & Freelance Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost wordfence.com
Mar 14, 2025Omnipress: Information ExposureCVE-2024-13407 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Omnipress
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 12, 2025Page Builder: Pagelayer – Drag and Drop website builder: Information ExposureCVE-2024-13430 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.8 via the 'pagelayer_builder_posts_shortcode' function due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private posts that they should not have access to.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 12, 2025NEX-Forms – Ultimate Form Builder – Contact forms and much more: Sensitive Information ExposureCVE-2024-13498 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.8.1 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.8.1
What to do
Affects up to 8.8.1. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2025Qubely – Advanced Gutenberg Blocks: Sensitive Information ExposureCVE-2024-13228 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data.
Product
Qubely – Advanced Gutenberg Blocks
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update Qubely – Advanced Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 10, 2025Gtbabel: Does not ensure that the URL to perform code analysis upon belongs to the blogCVE-2024-11638 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.
Product
Gtbabel
Fixed in
6.6.9
What to do
Update Gtbabel to 6.6.9 or newer.
Full record and what to do →NVD record wpscan.com
Mar 8, 2025WP-Recall – Registration, Profile, Commerce & More: Information ExposureCVE-2025-1322 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to view data from password protected, private, or draft posts that they should not have access to.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.10
What to do
Affects up to 16.26.10. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025All-in-One Addons for Elementor – WidgetKit: Sensitive Information ExposureCVE-2024-10321 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 in elements/advanced-tab/template/view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
All-in-One Addons for Elementor – WidgetKit
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update All-in-One Addons for Elementor – WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025Print Invoice & Delivery Notes for WooCommerce: Sensitive Information ExposureCVE-2024-13640 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.4.1 via the 'wcdn/invoice' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/wcdn/invoice directory which can contain invoice files if an email attachment setting is enabled.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025Post Lockdown: Information ExposureCVE-2025-1504 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocomplete' AJAX action due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Post Lockdown
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Post Lockdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 7, 2025VK Blocks: Sensitive Information ExposureCVE-2024-13635 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private posts and pages.
Product
VK Blocks
Affected
up to 1.94.2.2
What to do
Affects up to 1.94.2.2. Update VK Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2025Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More: Sensitive Information ExposureCVE-2024-11153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.0 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
Product
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 1, 2025GenerateBlocks: Sensitive Information ExposureCVE-2024-13546 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.1 via the 'get_image_description' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private, draft, and scheduled posts and pages.
Product
GenerateBlocks
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update GenerateBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2025Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: Sensitive Information ExposureCVE-2024-13611 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/bp-better-messages directory which can contain file attachments included in chat messages.
Product
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2025Database Backup and check Tables Automated With Scheduler 2024: Sensitive Information ExposureCVE-2024-13911 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials.
Product
Database Backup and check Tables Automated With Scheduler 2024
Affected
up to 2.35
What to do
Affects up to 2.35. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2025Fluent Support – Helpdesk & Customer Support Ticket System: Sensitive Information ExposureCVE-2024-13568 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory which can contain file attachments included in support tickets.
Product
Fluent Support – Helpdesk & Customer Support Ticket System
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Fluent Support – Helpdesk & Customer Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025Ultra Addons Lite for Elementor: Information ExposureCVE-2024-13832 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'ut_elementor' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Ultra Addons Lite for Elementor
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Ultra Addons Lite for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Order Attachments for WooCommerce: Sensitive Information ExposureCVE-2024-13638 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments added to orders.
Product
Order Attachments for WooCommerce
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Order Attachments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Post Grid and Gutenberg Blocks – ComboBlocks: Sensitive Information ExposureCVE-2024-13796 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.6 via the /wp-json/post-grid/v2/get_users REST API This makes it possible for unauthenticated attackers to extract sensitive data including including emails and other user data.
Product
Post Grid and Gutenberg Blocks – ComboBlocks
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Post Grid and Gutenberg Blocks – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025Jeg Elementor Kit: Sensitive Information ExposureCVE-2024-13217 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expired_data' and 'build_content' functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
Product
Jeg Elementor Kit
Affected
up to 2.6.11
What to do
Affects up to 2.6.11. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 26, 2025SureMembers: Sensitive Information ExposureCVE-2024-12434 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.6 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive data including restricted content.
Product
SureMembers
Affected
up to 1.10.6
What to do
Affects up to 1.10.6. Update SureMembers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record suremembers.com wordfence.com
Feb 25, 2025System Dashboard: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26911 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.
Product
System Dashboard
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.