Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,938 results · page 11 of 39

Mar 24, 2025Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its settingsCVE-2025-1062 · WordPress plugins & themes · reported by WPScanLow 3.5
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider, Gallery, and Carousel by MetaSlider
Fixed in
3.95.0
What to do
Update Slider, Gallery, and Carousel by MetaSlider to 3.95.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13124 · WordPress plugins & themes · reported by WPScanLow 3.5
The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.33
What to do
Update Photo Gallery by 10Web to 1.8.33 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10558 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.30
What to do
Update Form Maker by 10Web to 1.15.30 or newer.
Full record and what to do →NVD record wpscan.com
Mar 23, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2025-0718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Nested Pages
Fixed in
3.2.13
What to do
Update Nested Pages to 3.2.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2025Link My Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13881 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Link My Posts
Affected
up to 1.0
What to do
Affects up to 1.0. Update Link My Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025My Quota: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13880 · WordPress plugins & themes · reported by WPScanHigh 7.1
The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
My Quota
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update My Quota to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025SpotBot: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13878 · WordPress plugins & themes · reported by WPScanHigh 7.1
The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
SpotBot
Affected
up to 0.1.8
What to do
Affects up to 0.1.8. Update SpotBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025Passbeemedia Web Push Notification: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13877 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Passbeemedia Web Push Notification
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Passbeemedia Web Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025mEintopf: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13876 · WordPress plugins & themes · reported by WPScanHigh 7.1
The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
mEintopf
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update mEintopf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025WP-PManager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13875 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP-PManager
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 19, 2025Site Reviews: Does not properly sanitise and escape some of its Review fieldsCVE-2025-1232 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks
Product
Site Reviews
Fixed in
7.2.5
What to do
Update Site Reviews to 7.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1624 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.9
What to do
Update GDPR Cookie Compliance to 4.15.9 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1623 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.9
What to do
Update GDPR Cookie Compliance to 4.15.9 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1622 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.7
What to do
Update GDPR Cookie Compliance to 4.15.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025Poll Maker: Does not sanitise and escape some of its settingsCVE-2024-13602 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Poll Maker
Fixed in
5.5.4
What to do
Update Poll Maker to 5.5.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025WoWPth: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1487 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WoWPth
Affected
up to 2.0
What to do
Affects up to 2.0. Update WoWPth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025WoWPth: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1486 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WoWPth
Affected
up to 2.0
What to do
Affects up to 2.0. Update WoWPth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025WP Click Info: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1401 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Click Info WordPress plugin through 2.7.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WP Click Info
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update WP Click Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025Schedule: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13891 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Schedule WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Schedule
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025WP e-Customers Beta: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13885 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP e-Customers Beta
Affected
up to 0.0.1
What to do
Affects up to 0.0.1. Update WP e-Customers Beta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2025Limit Bio: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13884 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Limit Bio WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Limit Bio
Affected
up to 1.0
What to do
Affects up to 1.0. Update Limit Bio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 11, 2025Coronavirus (COVID-19) Notice Message: Does not sanitise and escape some of its settingsCVE-2025-0629 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Coronavirus (COVID-19) Notice Message
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Coronavirus (COVID-19) Notice Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025Countdown Timer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13864 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Countdown Timer
Affected
up to 1.0
What to do
Affects up to 1.0. Update Countdown Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13862 · WordPress plugins & themes · reported by WPScanHigh 7.1
The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality)
Affected
up to 8.0
What to do
Affects up to 8.0. Update S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025SEO Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13853 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
SEO Tools
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 11, 2025WP Login Control: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13836 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Login Control
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Login Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap: Does not sanitise and escape some of its settingsCVE-2024-13615 · WordPress plugins & themes · reported by WPScanLow 3.5
The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025XV Random Quotes: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13574 · WordPress plugins & themes · reported by WPScanHigh 7.1
The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
XV Random Quotes
Affected
up to 1.40
What to do
Affects up to 1.40. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 9, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Does not sanitise and escape some of its settingsCVE-2025-1363 · WordPress plugins & themes · reported by WPScanLow 3.5
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
URL Shortener | Conversion Tracking | AB Testing | WooCommerce
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 8, 2025Email Keep: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13825 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Email Keep
Affected
up to 1.1
What to do
Affects up to 1.1. Update Email Keep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2025Post Meta Data Manager: Multisite privilege escalationCVE-2024-13835 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying the existence of a multisite installation prior to allowing user meta to be added/modified. This makes it possible for authenticated attackers, with Administrator-level access and above, to gain elevated privileges on subsites that would otherwise be inaccessible.
Product
Post Meta Data Manager
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 7, 2025Reservit Hotel: Does not sanitise and escape some of its settingsCVE-2024-9458 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Reservit Hotel
Fixed in
3.0
What to do
Update Reservit Hotel to 3.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 7, 2025WordPress Activity O Meter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13668 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.
Product
WordPress Activity O Meter
Affected
up to 1.0
What to do
Affects up to 1.0. Update WordPress Activity O Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 6, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13868 · WordPress plugins & themes · reported by WPScanMedium 6.1
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
URL Shortener | Conversion Tracking | AB Testing | WooCommerce
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 5, 2025Zass - WooCommerce Theme for Handmade Artists and Artisans: Unauthorized accessCVE-2024-13810 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zass_import_zass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo content and overwrite the site.
Product
Zass - WooCommerce Theme for Handmade Artists and Artisans
Affected
up to 3.9.9.10
What to do
Affects up to 3.9.9.10. Update Zass - WooCommerce Theme for Handmade Artists and Artisans to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 26, 2025R3W InstaFeed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13678 · WordPress plugins & themes · reported by WPScanMedium 6.1
The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
R3W InstaFeed
Affected
up to 1.0
What to do
Affects up to 1.0. Update R3W InstaFeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025CalendApp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13669 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
CalendApp
Affected
up to 1.1
What to do
Affects up to 1.1. Update CalendApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Post Sync: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13634 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Post Sync
Affected
up to 1.1
What to do
Affects up to 1.1. Update Post Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Simple catalogue: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13633 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Simple catalogue
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Simple catalogue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WP Extra Fields: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13632 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Extra Fields
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Om Stripe: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13631 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Om Stripe
Affected
up to 02.00.00
What to do
Affects up to 02.00.00. Update Om Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025NewsTicker: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13630 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
NewsTicker
Affected
up to 1.0
What to do
Affects up to 1.0. Update NewsTicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025pushBIZ: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13629 · WordPress plugins & themes · reported by WPScanMedium 6.1
The pushBIZ WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
pushBIZ
Affected
up to 1.0
What to do
Affects up to 1.0. Update pushBIZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WP Pricing Table: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13628 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Pricing Table
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WPMovieLibrary: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13624 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WPMovieLibrary
Affected
up to 2.1.4.8
What to do
Affects up to 2.1.4.8. Update WPMovieLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Post Timeline: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13571 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Post Timeline
Fixed in
2.3.10
What to do
Update Post Timeline to 2.3.10 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Countdown Timer for Elementor: Does not sanitise and escape some parametersCVE-2024-13113 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
Countdown Timer for Elementor
Fixed in
1.3.7
What to do
Update Countdown Timer for Elementor to 1.3.7 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.