Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,183 results · page 14 of 64
Mar 13, 2026the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries: WpDiscuz before 7.6.47 contains an SQL injectionCVE-2026-22193 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.
- Product
- the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries
- Fixed in
- 7.6.47
- What to do
- Update the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 12, 2026Reading progressbar: Does not sanitise and escape some of its settingsCVE-2026-2687 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Reading progressbar
- Fixed in
- 1.3.1
- What to do
- Update Reading progressbar to 1.3.1 or newer.
Mar 11, 2026DukaPress: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-2466 · WordPress plugins & themes · reported by WPScanHigh 7.1
The DukaPress WordPress plugin through 3.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- DukaPress
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update DukaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026SiteGuard WP: Guessable CAPTCHACVE-2026-27411 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Guessable CAPTCHA vulnerability in jp-secure SiteGuard WP Plugin siteguard allows Functionality Bypass.This issue affects SiteGuard WP Plugin: from n/a through <= 1.7.9.
- Product
- SiteGuard WP
- Affected
- up to 1.7.9
- What to do
- Affects up to 1.7.9. Update SiteGuard WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2026wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpfoCVE-2026-28557 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Feb 22, 2026Conditional CAPTCHA: Does not validate a parameter before redirecting the user to its valueCVE-2026-1369 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
- Product
- Conditional CAPTCHA
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Conditional CAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Capella: Deserialization of Untrusted DataCVE-2025-69370 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.
- Product
- Capella
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update Capella to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026hCaptcha for WP: Missing AuthorizationCVE-2026-25315 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.21.1.
- Product
- hCaptcha for WP
- Affected
- up to 4.21.1
- What to do
- Affects up to 4.21.1. Update hCaptcha for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2026RegistrationMagic: Does not have proper capability checksCVE-2026-0929 · WordPress plugins & themes · reported by WPScanMedium 4.3
The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site.
- Product
- RegistrationMagic
- Fixed in
- 6.0.7.2
- What to do
- Update RegistrationMagic to 6.0.7.2 or newer.
Feb 13, 2026RegistrationMagic: Checks nonces but not capabilitiesCVE-2025-15520 · WordPress plugins & themes · reported by WPScanMedium 4.3
The RegistrationMagic WordPress plugin before 6.0.7.2 checks nonces but not capabilities, allowing for the disclosure of some sensitive data to subscribers and above.
- Product
- RegistrationMagic
- Fixed in
- 6.0.7.2
- What to do
- Update RegistrationMagic to 6.0.7.2 or newer.
Feb 11, 2026OpenPix for WooCommerce: Allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checksCVE-2025-15400 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.
- Product
- OpenPix for WooCommerce
- Affected
- up to 2.13.3
- What to do
- Affects up to 2.13.3. Update OpenPix for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026Copyscape Premium: Cross-Site Request Forgery (CSRF)CVE-2026-24966 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Copyscape Copyscape Premium copyscape-premium allows Cross Site Request Forgery.This issue affects Copyscape Premium: from n/a through <= 1.4.1.
- Product
- Copyscape Premium
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Copyscape Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 2, 2026Library Viewer: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2025-15396 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Library Viewer
- Fixed in
- 3.2.0
- What to do
- Update Library Viewer to 3.2.0 or newer.
Jan 26, 2026Recipe Card Blocks Lite: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-14973 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.
- Product
- Recipe Card Blocks Lite
- Fixed in
- 3.4.13
- What to do
- Update Recipe Card Blocks Lite to 3.4.13 or newer.
Jan 26, 2026AhaChat Messenger Marketing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14316 · WordPress plugins & themes · reported by WPScanHigh 7.1
The AhaChat Messenger Marketing WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- AhaChat Messenger Marketing
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AhaChat Messenger Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2026ZT Captcha: Cross-Site Request ForgeryCVE-2026-1075 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ZT Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to improper nonce validation on the save_ztcpt_captcha_settings action where the nonce check can be bypassed by sending an empty token value. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ZT Captcha
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update ZT Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49055 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.
- Product
- WP Lead Capturing Pages
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49050 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.
- Product
- WP Lead Capturing Pages
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 20, 2026Bookingor: Exposes authenticated AJAX actions without capability or nonce checksCVE-2025-12573 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress plugin through 1.0.12 data.
- Product
- Bookingor
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update Bookingor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2026Dreamer Blog: Is vulnerable to arbitrary installations due to a missing capability checkCVE-2025-10915 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.
- Product
- Dreamer Blog
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Dreamer Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 12, 2026Quiz Maker: Does not sanitise and escape some of its settingsCVE-2025-14579 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Maker WordPress plugin before 6.7.0.89 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Quiz Maker
- Fixed in
- 6.7.0.89
- What to do
- Update Quiz Maker to 6.7.0.89 or newer.
Jan 9, 2026NEX-Forms: Does not sanitise and escape some of its settingsCVE-2025-14803 · WordPress plugins & themes · reported by WPScanMedium 6.8
The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.
- Product
- NEX-Forms
- Fixed in
- 9.1.8
- What to do
- Update NEX-Forms to 9.1.8 or newer.
Jan 7, 2026Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium: Do not sanitize and escape a parameter before using it in a SQL statementCVE-2025-14719 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowing contributor and above roles to perform SQL injection attacks
- Product
- Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium
- Fixed in
- 4.26.0
- What to do
- Update Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium to 4.26.0 or newer.
Jan 7, 2026MTCaptcha: Cross-Site Request ForgeryCVE-2025-13520 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin settings, including sensitive values like the private key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- MTCaptcha
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update MTCaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2026FlexTable: Does not sanitise and escape the imported links from Google Sheet cellsCVE-2025-9543 · WordPress plugins & themes · reported by WPScanLow 3.5
The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- FlexTable
- Fixed in
- 3.19.2
- What to do
- Update FlexTable to 3.19.2 or newer.
Jan 5, 2026Team: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-14124 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Team
- Fixed in
- 5.0.11
- What to do
- Update Team to 5.0.11 or newer.
Jan 2, 2026ShopBuilder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13456 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ShopBuilder
- Fixed in
- 3.2.2
- What to do
- Update ShopBuilder to 3.2.2 or newer.
Jan 2, 2026Logo Slider: Does not validate and escape some of its slider options before outputting them back in the dashboardCVE-2025-13153 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Logo Slider
- Fixed in
- 4.9.0
- What to do
- Update Logo Slider to 4.9.0 or newer.
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14313 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14312 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025YaMaps for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-13958 · WordPress plugins & themes · reported by WPScanMedium 5.9
The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- YaMaps for
- Fixed in
- 0.6.40
- What to do
- Update YaMaps for to 0.6.40 or newer.
Dec 29, 2025Plugin Organizer: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-13417 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks.
- Product
- Plugin Organizer
- Fixed in
- 10.2.4
- What to do
- Update Plugin Organizer to 10.2.4 or newer.
Dec 24, 2025Captivate Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68570 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through <= 3.2.2.
- Product
- Captivate Sync
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Claspo – Popups, Spin the Wheel & Email Capture: Missing AuthorizationCVE-2025-68568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Claspo – Popups, Spin the Wheel & Email Capture: from n/a through <= 1.0.7.
- Product
- Claspo – Popups, Spin the Wheel & Email Capture
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Claspo – Popups, Spin the Wheel & Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Email Capture: Cross-Site Request Forgery (CSRF)CVE-2025-68529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.
- Product
- WP Email Capture
- Affected
- up to 3.12.5
- What to do
- Affects up to 3.12.5. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2025The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cCVE-2025-7782 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cs_update_application_status_callback' function in all versions up to, and including, 7.7. This makes it possible for authenticated attackers, with Candidate-level access and above, to inject cross-site scripting into the 'status' parameter of applied jobs for any user.
- Affected
- up to 7.7
- What to do
- Affects up to 7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Dec 15, 2025URL Shortify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13355 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- URL Shortify
- Fixed in
- 1.11.4
- What to do
- Update URL Shortify to 1.11.4 or newer.
Dec 15, 2025URL Shortify: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-12684 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins.
- Product
- URL Shortify
- Fixed in
- 1.11.3
- What to do
- Update URL Shortify to 1.11.3 or newer.
Dec 13, 2025WPS Visitor Counter: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-9116 · WordPress plugins & themes · reported by WPScanMedium 5.8
The WPS Visitor Counter WordPress plugin through 1.4.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- WPS Visitor Counter
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update WPS Visitor Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13073 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- HandL UTM Grabber / Tracker
- Fixed in
- 2.8.1
- What to do
- Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13072 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- HandL UTM Grabber / Tracker
- Fixed in
- 2.8.1
- What to do
- Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Dec 9, 2025WP Email Capture: Missing AuthorizationCVE-2025-67578 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Email Capture: from n/a through <= 3.12.4.
- Product
- WP Email Capture
- Affected
- up to 3.12.4
- What to do
- Affects up to 3.12.4. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Image Caption Hover Pro: Missing AuthorizationCVE-2025-67562 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WebCodingPlace Image Caption Hover Pro image-caption-hover-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Caption Hover Pro: from n/a through < 20.0.
- Product
- Image Caption Hover Pro
- What to do
- Update Image Caption Hover Pro to the newest version.
Dec 9, 2025Custom Admin Menu: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13071 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Custom Admin Menu
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Admin Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WPeMatico RSS Feed Fetcher: Does not sanitize and escape some of its settingsCVE-2025-13031 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.13
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.13 or newer.
Dec 5, 2025Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents: Cross-Site Request ForgeryCVE-2025-12189 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage() function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents
- Affected
- up to 7.11.1374
- What to do
- Affects up to 7.11.1374. Update Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Dec 2, 2025Upload.am: Is vulnerable to arbitrary option disclosure due to a missing capability check on its AJAX request handlerCVE-2025-12630 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Upload.am WordPress plugin before 1.0.1 is vulnerable to arbitrary option disclosure due to a missing capability check on its AJAX request handler, allowing users such as contributor to view site options.
- Product
- Upload.am
- Fixed in
- 1.0.1
- What to do
- Update Upload.am to 1.0.1 or newer.
Dec 2, 2025donation: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-13001 · WordPress plugins & themes · reported by WPScanMedium 4.1
The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks
- Product
- donation
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2025Broken Link Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-12629 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Broken Link Manager
- Affected
- up to 0.6.5
- What to do
- Affects up to 0.6.5. Update Broken Link Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2025WordPress eCommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-14015 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WordPress eCommerce
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update WordPress eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.