Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
640 results · page 13 of 13
Oct 18, 2021Compact WP Audio Player: Does not escape some of its shortcodes attributesCVE-2021-24734 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Compact WP Audio Player
- Fixed in
- 1.9.7
- What to do
- Update Compact WP Audio Player to 1.9.7 or newer.
Oct 18, 2021PDF Flipbook, 3D Flipbook WordPress – DearFlip: Does not escape the class attribute of its shortcode before outputting it back in an attributeCVE-2021-24732 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- PDF Flipbook, 3D Flipbook WordPress – DearFlip
- Fixed in
- 1.7.10
- What to do
- Update PDF Flipbook, 3D Flipbook WordPress – DearFlip to 1.7.10 or newer.
Oct 18, 2021One User Avatar: Does not escape the link and target attributes of its shortcodeCVE-2021-24672 · WordPress plugins & themes · reported by WPScanMedium 5.4
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- One User Avatar
- Fixed in
- 2.3.7
- What to do
- Update One User Avatar to 2.3.7 or newer.
Oct 18, 2021PlanSo Forms: Does not escape the title of its Form before outputting it in attributesCVE-2021-24516 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
- Product
- PlanSo Forms
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update PlanSo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.2
- What to do
- Update Modern Events Calendar Lite to 5.22.2 or newer.
Oct 4, 2021CM Tooltip Glossary: Does not escape some glossary_tooltip shortcode attributesCVE-2021-24678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- CM Tooltip Glossary
- Fixed in
- 3.9.21
- What to do
- Update CM Tooltip Glossary to 3.9.21 or newer.
Sep 27, 2021MX Time Zone Clocks: Does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcodeCVE-2021-24671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- MX Time Zone Clocks
- Fixed in
- 3.4.1
- What to do
- Update MX Time Zone Clocks to 3.4.1 or newer.
Sep 27, 2021CoolClock: Does not escape some shortcode attributesCVE-2021-24670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks
- Product
- CoolClock
- Fixed in
- 4.3.5
- What to do
- Update CoolClock to 4.3.5 or newer.
Sep 27, 2021WP Map Block: Does not escape some attributes of the WP Map BlockCVE-2021-24643 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WP Map Block
- Fixed in
- 1.2.3
- What to do
- Update WP Map Block to 1.2.3 or newer.
Sep 20, 2021The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as lCVE-2021-24640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WordPress Slider Block Gutenslider
- Fixed in
- 5.2.0
- What to do
- Update WordPress Slider Block Gutenslider to 5.2.0 or newer.
Sep 20, 2021WP Mapa Politico Espana: Does not sanitise or escape some of its settings before outputting them in attributesCVE-2021-24609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP Mapa Politico Espana
- Fixed in
- 3.7.0
- What to do
- Update WP Mapa Politico Espana to 3.7.0 or newer.
Sep 20, 2021Availability Calendar: Does not escape the category attribute from its shortcode before using it in a SQL statementCVE-2021-24606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
- Product
- Availability Calendar
- Fixed in
- 1.2.1
- What to do
- Update Availability Calendar to 1.2.1 or newer.
Sep 20, 2021Shortcodes Ultimate: Allows users with Contributor roles to perform stored XSS via shortcode attributesCVE-2021-24525 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).
- Product
- Shortcodes Ultimate
- Fixed in
- 5.10.2
- What to do
- Update Shortcodes Ultimate to 5.10.2 or newer.
Aug 30, 2021WP Video Lightbox: Does not escape the attributes of its shortcodesCVE-2021-24665 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WP Video Lightbox
- Fixed in
- 1.9.3
- What to do
- Update WP Video Lightbox to 1.9.3 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Aug 30, 2021ShareThis Dashboard for Google Analytics: Does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attributeCVE-2021-24438 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- ShareThis Dashboard for Google Analytics
- Fixed in
- 2.5.2
- What to do
- Update ShareThis Dashboard for Google Analytics to 2.5.2 or newer.
Aug 23, 2021HD Quiz: Does not escape some of its Answers before outputting them in attributeCVE-2021-24571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to Stored Cross-Site Scripting issues
- Product
- HD Quiz
- Fixed in
- 1.8.4
- What to do
- Update HD Quiz to 1.8.4 or newer.
Aug 23, 2021WPFront Scroll Top: Does not sanitise or escape its Image ALT setting before outputting it attributesCVE-2021-24564 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
- Product
- WPFront Scroll Top
- Fixed in
- 2.0.6.07225
- What to do
- Update WPFront Scroll Top to 2.0.6.07225 or newer.
Aug 23, 2021Slider Hero with Animation, Video Background & Intro Maker: Does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statementCVE-2021-24506 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
- Product
- Slider Hero with Animation, Video Background & Intro Maker
- Fixed in
- 8.2.7
- What to do
- Update Slider Hero with Animation, Video Background & Intro Maker to 8.2.7 or newer.
Aug 16, 2021SP Project & Document Manager: Attribute-based Reflected Cross-Site ScriptingCVE-2021-38315 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25.
- Product
- SP Project & Document Manager
- Affected
- up to 4.25
- What to do
- Affects up to 4.25. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 16, 2021PhoneTrack Meu Site Manager: Does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the pageCVE-2021-24534 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
- Product
- PhoneTrack Meu Site Manager
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update PhoneTrack Meu Site Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Does not escape its Form Title before outputting it in an attributeCVE-2021-24526 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- Fixed in
- 1.13.60
- What to do
- Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to 1.13.60 or newer.
Aug 2, 2021Leaflet Map: Does not escape some shortcode attributes before they are used in JavaScript code or HTMLCVE-2021-24468 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues
- Product
- Leaflet Map
- Fixed in
- 3.0.0
- What to do
- Update Leaflet Map to 3.0.0 or newer.
Aug 2, 2021The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-atCVE-2021-24457 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Fixed in
- 1.1.8
- What to do
- Update the plugin to 1.1.8 or newer.
Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
- Product
- Tutor LMS – eLearning and online course solution
- Fixed in
- 1.9.2
- What to do
- Update Tutor LMS – eLearning and online course solution to 1.9.2 or newer.
Jul 12, 2021Prismatic: Does not escape the 'tab' GET parameter before outputting it back in an attributeCVE-2021-24409 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- Prismatic
- Fixed in
- 2.8
- What to do
- Update Prismatic to 2.8 or newer.
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attributeCVE-2021-24372 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
- Product
- WP Hardening – Fix Your WordPress Security
- Fixed in
- 1.2.2
- What to do
- Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Jun 1, 2021Database Backup for: Did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tagCVE-2021-24322 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
- Product
- Database Backup for
- Fixed in
- 2.4
- What to do
- Update Database Backup for to 2.4 or newer.
May 14, 2021The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.CVE-2021-24283 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.
- Fixed in
- 2.2.30
- What to do
- Update the plugin to 2.2.30 or newer.
May 5, 2021Contact Form by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24276 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Contact Form by Supsystic
- Fixed in
- 1.7.15
- What to do
- Update Contact Form by Supsystic to 1.7.15 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Popup by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24275 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Popup by Supsystic
- Fixed in
- 1.10.5
- What to do
- Update Popup by Supsystic to 1.10.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Ultimate Maps by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24274 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Ultimate Maps by Supsystic
- Fixed in
- 1.2.5
- What to do
- Update Ultimate Maps by Supsystic to 1.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 12, 2021Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: Did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attributeCVE-2021-24221 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
- Product
- Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for
- Fixed in
- 7.1.12
- What to do
- Update Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for to 7.1.12 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 18, 2021Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, CVE-2021-24143 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections.
- Fixed in
- 1.8.1
- What to do
- Update the plugin to 1.8.1 or newer.
Sep 16, 2020A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions.CVE-2020-20406 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Nov 11, 2019A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributCVE-2019-18855 · WordPress plugins & themes · reported by MITREHigh 7.5
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes.
- Product
- A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG)
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfortiguard.complugins.trac.wordpress.org
Apr 7, 2018The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.CVE-2018-9844 · WordPress plugins & themes · reported by MITREMedium 6.1
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.
- Product
- Iptanus WordPress File Upload
- Fixed in
- 4.3.4
- What to do
- Update Iptanus WordPress File Upload to 4.3.4 or newer.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Apr 1, 2018The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.CVE-2018-9172 · WordPress plugins & themes · reported by MITREMedium 5.4
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.
- Product
- Iptanus WordPress File Upload
- Fixed in
- 4.3.3
- What to do
- Update Iptanus WordPress File Upload to 4.3.3 or newer.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Dec 2, 2017wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to condCVE-2017-17093 · WordPress plugins & themes · reported by MITREMedium 5.4
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.
- Fixed in
- 4.9.1
- What to do
- Update the plugin to 4.9.1 or newer.
Full record and what to do →NVD recordsecurityfocus.comcodex.wordpress.org
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.CVE-2016-5837 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
- Fixed in
- 4.5.3
- What to do
- Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Apr 21, 2012wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conductCVE-2012-2403 · WordPress plugins & themes · reported by MITREMedium 4.3
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
- Fixed in
- 3.3.2
- What to do
- Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.