Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,886 results · page 15 of 98
Mar 15, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Stored Cross-Site ScriptingCVE-2024-13497 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file.
- Product
- WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
- Affected
- up to 8.0.9
- What to do
- Affects up to 8.0.9. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 14, 2025Directory Listings WordPress plugin – uListing: Unauthorized modification of data and PHP Object InjectionCVE-2025-1657 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update post meta data and inject PHP Objects that may be unserialized. A capability check was added in 2.1.8, but the unserialize is still present.
- Product
- Directory Listings WordPress plugin – uListing
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Directory Listings WordPress plugin – uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 14, 2025Directory Listings WordPress plugin – uListing: Privilege EscalationCVE-2025-1653 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user meta that can be updated. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
- Product
- Directory Listings WordPress plugin – uListing
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Directory Listings WordPress plugin – uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Mar 14, 2025The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, andCVE-2025-2232 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.purethemes.networdfence.com
Mar 13, 2025Business Directory Plugin – Easy Listing Directories for: Insecure Direct Object ReferenceCVE-2024-13887 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.14 via the 'ajax_listing_submit_image_upload' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to add arbitrary images to listings.
- Product
- Business Directory Plugin – Easy Listing Directories for
- Affected
- up to 6.4.14
- What to do
- Affects up to 6.4.14. Update Business Directory Plugin – Easy Listing Directories for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 11, 2025List of Posts from each Category plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-28894 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through <= 2.0.
- Product
- List of Posts from each Category plugin for
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update List of Posts from each Category plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Plugins Last Updated Column: Cross-Site Request Forgery (CSRF)CVE-2025-28887 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fastmover Plugins Last Updated Column plugins-last-updated-column allows Cross Site Request Forgery.This issue affects Plugins Last Updated Column: from n/a through <= 0.1.3.
- Product
- Plugins Last Updated Column
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Plugins Last Updated Column to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap: Does not sanitise and escape some of its settingsCVE-2024-13615 · WordPress plugins & themes · reported by WPScanLow 3.5
The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2025SEO Plugin by Squirrly SEO: Blind SQL InjectionCVE-2025-1768 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4.05 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- SEO Plugin by Squirrly SEO
- Affected
- up to 12.4.05
- What to do
- Affects up to 12.4.05. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 7, 2025Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins: Cross-Site Request ForgeryCVE-2024-12634 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 2.0.59. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins
- Affected
- up to 2.0.59
- What to do
- Affects up to 2.0.59. Update Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2025Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics: Unauthorized modification of dataCVE-2025-1666 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the send_uninstall_survey() function in all versions up to, and including, 4.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit the uninstall survey on behalf of a website.
- Product
- Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 5, 2025Sparkling: Unauthorized plugin activation/deactivationCVE-2024-13423 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions in versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to activate/deactivate arbitrary plugins.
- Product
- Sparkling
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Sparkling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Mar 5, 2025Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More: Sensitive Information ExposureCVE-2024-11153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.0 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
- Product
- Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 5, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1.7CVE-2024-5667 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1.7.14) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 5, 2025Staff Directory Plugin: Company Directory: Reflected Cross-Site ScriptingCVE-2024-13839 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Staff Directory Plugin: Company Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Staff Directory Plugin: Company Directory
- Affected
- up to 4.3
- What to do
- Affects up to 4.3. Update Staff Directory Plugin: Company Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 5, 2025The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalatioCVE-2024-13232 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalation due to a missing capability check on the renderImport() function in all versions up to, and including, 4.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary SQL statements that can leveraged to create a new administrative user account.
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 4, 2025WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2025-0370 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Affected
- up to 7.3.3
- What to do
- Affects up to 7.3.3. Update WP Shortcodes Plugin — Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 3, 2025Animation Addons for Elementor Pro: Unauthorized arbitrary plugin installationCVE-2025-1639 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to further infect a victim when Elementor is not activated on a vulnerable site.
- Product
- Animation Addons for Elementor Pro
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Animation Addons for Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 3, 2025Staff Directory Plugin: Company Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25165 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richardgabriel Staff Directory Plugin: Company Directory staff-directory-pro allows Stored XSS.This issue affects Staff Directory Plugin: Company Directory: from n/a through <= 4.3.
- Product
- Staff Directory Plugin: Company Directory
- Affected
- up to 4.3
- What to do
- Affects up to 4.3. Update Staff Directory Plugin: Company Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025WP-HR Manager: The Human Resources Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23843 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphrmanager WP-HR Manager: The Human Resources Plugin for WordPress wp-hr-manager allows Reflected XSS.This issue affects WP-HR Manager: The Human Resources Plugin for WordPress: from n/a through <= 3.1.0.
- Product
- WP-HR Manager: The Human Resources Plugin for
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update WP-HR Manager: The Human Resources Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025SEO Plugin by Squirrly SEO: Missing AuthorizationCVE-2025-24654 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo.This issue affects SEO Plugin by Squirrly SEO: from n/a through <= 12.4.07.
- Product
- SEO Plugin by Squirrly SEO
- Affected
- up to 12.4.07
- What to do
- Affects up to 12.4.07. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2025Multilevel Referral Affiliate Plugin for WooCommerce: SQL InjectionCVE-2024-13750 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Multilevel Referral Affiliate Plugin for WooCommerce
- Affected
- up to 2.28
- What to do
- Affects up to 2.28. Update Multilevel Referral Affiliate Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Privilege escalationCVE-2025-1570 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_generate_password_reset_pin_code() and reset_user_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
- Product
- Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 28, 2025Pricing Table by PickPlugins: Stored Cross-Site ScriptingCVE-2024-13469 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1.12.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Pricing Table by PickPlugins
- Affected
- up to 1.12.10
- What to do
- Affects up to 1.12.10. Update Pricing Table by PickPlugins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Feb 28, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WorCVE-2025-1513 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Name and Comment field when commenting on photo gallery entries in all versions up to, and including, 26.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 26.0.0.1
- What to do
- Affects up to 26.0.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 27, 2025The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerablCVE-2025-1450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-hover’ parameter in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 27, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Server-Side Request ForgeryCVE-2024-13907 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.16.8
- What to do
- Affects up to 1.16.8. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 26, 2025The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2025-1517 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 21, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Local File InclusionCVE-2024-13353 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.4 via several widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2025The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress CVE-2024-13818 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.4 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.
- Affected
- up to 3.8.4
- What to do
- Affects up to 3.8.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2025UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included: Stored Cross-Site ScriptingCVE-2024-11335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframe' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Feb 18, 2025Affiliate Links: WordPress Plugin for Link Cloaking and Link Management: PHP Object InjectionCVE-2024-13556 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.1 via deserialization of untrusted input from an file export. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- Affiliate Links: WordPress Plugin for Link Cloaking and Link Management
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Affiliate Links: WordPress Plugin for Link Cloaking and Link Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 18, 2025GetBookingsWP – Appointments Booking Calendar Plugin For: Privilege escalationCVE-2024-13677 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.27. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- GetBookingsWP – Appointments Booking Calendar Plugin For
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update GetBookingsWP – Appointments Booking Calendar Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Sensitive Information ExposureCVE-2024-13609 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.
- Product
- 1 Click WordPress Migration Plugin – 100% FREE for a limited time
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Cross-Site Request ForgeryCVE-2024-13555 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancel_actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- 1 Click WordPress Migration Plugin – 100% FREE for a limited time
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 16, 2025AWS S3 for WordPress Plugin – Upcasted: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22676 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in upcasted AWS S3 for WordPress Plugin – Upcasted upcasted-s3-offload allows Stored XSS.This issue affects AWS S3 for WordPress Plugin – Upcasted: from n/a through <= 3.0.3.
- Product
- AWS S3 for WordPress Plugin – Upcasted
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update AWS S3 for WordPress Plugin – Upcasted to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 15, 2025Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter.CVE-2025-0822 · WordPress plugins & themes · reported by WordfenceMedium 6.5
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 15, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Time-based SQL InjectionCVE-2024-13500 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
- Affected
- up to 2.6.17
- What to do
- Affects up to 2.6.17. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 15, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Unauthorized loss of dataCVE-2024-13752 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cause a persistent denial of service condition.
- Product
- WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
- Affected
- up to 2.6.17
- What to do
- Affects up to 2.6.17. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 15, 2025Media Library Folders: Unauthorized plugin settings changeCVE-2025-0935 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to change plugin settings related to things such as IP-blocking.
- Product
- Media Library Folders
- Affected
- up to 8.3.0
- What to do
- Affects up to 8.3.0. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 15, 2025Maps Plugin using Google Maps for WordPress: Does not sanitise and escape some of its settingsCVE-2024-13306 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Maps Plugin using Google Maps for WordPress
- Fixed in
- 1.9.4
- What to do
- Update Maps Plugin using Google Maps for WordPress to 1.9.4 or newer.
Feb 15, 2025Maps Plugin using Google Maps for WordPress: Does not sanitise and escape some of its settingsCVE-2024-13208 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Maps Plugin using Google Maps for WordPress
- Fixed in
- 1.9.4
- What to do
- Update Maps Plugin using Google Maps for WordPress to 1.9.4 or newer.
Feb 14, 2025Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficientCVE-2025-0821 · WordPress plugins & themes · reported by WordfenceMedium 6.5
Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2025Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function.CVE-2024-13791 · WordPress plugins & themes · reported by WordfenceMedium 4.9
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 13, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its settingsCVE-2024-13121 · WordPress plugins & themes · reported by WPScanLow 3.5
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.20
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.20 or newer.
Feb 13, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its settingsCVE-2024-13120 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.20
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.20 or newer.
Feb 13, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its settingsCVE-2024-13119 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.20
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.20 or newer.
Feb 12, 2025Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands: Stored Cross-Site ScriptingCVE-2024-11746 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_brand' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 11, 2025GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2024-13506 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Affected
- up to 2.8.97
- What to do
- Affects up to 2.8.97. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2025Plugin A/B Image Optimizer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-25163 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through <= 3.3.
- Product
- Plugin A/B Image Optimizer
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Plugin A/B Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.