Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

2,382 results · page 16 of 48

Jan 23, 2026Livemesh Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24594 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for WPBakery Page Builder addons-for-visual-composer allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through <= 3.9.4.
Product
Livemesh Addons for WPBakery Page Builder
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Livemesh Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Stored Cross-Site ScriptingCVE-2025-15522 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord_user_mapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output escaping on the verified_message parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user with a verified Discord account accesses the injected page.
Product
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
Affected
up to 6.10.0.2
What to do
Affects up to 6.10.0.2. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2026Easy Form Builder: Missing AuthorizationCVE-2026-22472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.9.6.
Product
Easy Form Builder
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Beaver Builder: Improper Control of Generation of Code ('Code Injection')CVE-2025-69319 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Code Injection.This issue affects Beaver Builder: from n/a through <= 2.9.4.1.
Product
Beaver Builder
Affected
up to 2.9.4.1
What to do
Affects up to 2.9.4.1. Update Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026BM Content Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69055 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.
Product
BM Content Builder
What to do
Update BM Content Builder to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Contact Form & Lead Form Elementor Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.
Product
Contact Form & Lead Form Elementor Builder
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Contact Form & Lead Form Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Typebot is an open-source chatbot builder.CVE-2025-65098 · Other software · baptisteArno · reported by GitHubHigh 7.4
Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership. Version 3.13.2 fixes the issue.
Product
typebot.io
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2026Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor: Arbitrary file readsCVE-2025-13725 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 1.0.1. This is due to insufficient path validation in the server-side rendering of the thim-blocks/icon block. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server via the 'iconSVG' parameter, which can contain sensitive information such as wp-config.php.
Product
Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Cost Calculator Builder: Unauthenticated Payment Status BypassCVE-2025-14757 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment.
Product
Cost Calculator Builder
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.CVE-2025-63644 · Other software · Ph7builder · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.
Product
Ph7 Social Dating Builder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com medium.com
Jan 14, 2026Internal Link Builder: Stored Cross-Site ScriptingCVE-2025-14725 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Internal Link Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Internal Link Builder
Affected
up to 1.0
What to do
Affects up to 1.0. Update Internal Link Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2026DASHBOARD BUILDER – WordPress plugin for Charts and Graphs: Cross-Site Request ForgeryCVE-2025-14615 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.7. This is due to missing nonce validation on the settings handler in dashboardbuilder-admin.php. This makes it possible for unauthenticated attackers to modify the stored SQL query and database credentials used by the [show-dashboardbuilder] shortcode via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The modified SQL query is subsequently executed on the front-end when the shortcode is rendered, enabling arbitrary SQL injection and data exfiltration through the publicly visible chart output.
Product
DASHBOARD BUILDER – WordPress plugin for Charts and Graphs
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update DASHBOARD BUILDER – WordPress plugin for Charts and Graphs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026SpiceForms Form Builder: Stored Cross-Site ScriptingCVE-2025-12178 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SpiceForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spiceforms' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SpiceForms Form Builder
Affected
up to 1.0
What to do
Affects up to 1.0. Update SpiceForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2026ConvertForce Popup Builder: Stored Cross-Site ScriptingCVE-2025-14506 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ConvertForce Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gutenberg block's `entrance_animation` attribute in all versions up to, and including, 0.0.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ConvertForce Popup Builder
Affected
up to 0.0.7
What to do
Affects up to 0.0.7. Update ConvertForce Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 10, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2025-14976 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.8. This is due to missing or incorrect nonce validation on the 'process_row_actions' function with the 'delete' action. This makes it possible for unauthenticated attackers to delete arbitrary post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected
up to 4.4.8
What to do
Affects up to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026WP Table Builder – Drag & Drop Table Builder: Unauthorized modification of dataCVE-2025-13753 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization check on the save_table() function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new wptb-table posts.
Product
WP Table Builder – Drag & Drop Table Builder
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update WP Table Builder – Drag & Drop Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Jan 9, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Authorization bypassCVE-2025-14782 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with access to the Forminator dashboard, to export sensitive form submission data including personally identifiable information.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.49.1
What to do
Affects up to 1.49.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2026Dashboard Welcome for Beaver Builder: Missing AuthorizationCVE-2026-22488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Welcome for Beaver Builder: from n/a through <= 1.0.8.
Product
Dashboard Welcome for Beaver Builder
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Dashboard Welcome for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Taskbuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67933 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in taskbuilder Taskbuilder taskbuilder allows Reflected XSS.This issue affects Taskbuilder: from n/a through <= 4.0.9.
Product
Taskbuilder
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Taskbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible CVE-2025-12776 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333Low 1.8
The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. The Report Builder is part of the WebConsole. The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes.
Product
WebConsole
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.commvault.com
Jan 7, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Missing AuthorizationCVE-2025-13722 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.7. This is due to missing capability checks on the `fluentform_ai_create_form` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary forms via the publicly exposed AI builder.
Product
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026Stylish Order Form Builder: Stored Cross-Site ScriptingCVE-2025-13531 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Stylish Order Form Builder
Affected
up to 1.0
What to do
Affects up to 1.0. Update Stylish Order Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2026Woocommerce Sales Funnel Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows Reflected XSS.This issue affects Woocommerce Sales Funnel Builder: from n/a through 1.1; Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.
Product
Woocommerce Sales Funnel Builder
Affected
up to 1.1
What to do
Affects up to 1.1. Update Woocommerce Sales Funnel Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 6, 2026Post and Page Builder by BoldGrid: Missing AuthorizationCVE-2025-69345 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9.
Product
Post and Page Builder by BoldGrid
Affected
up to 1.27.9
What to do
Affects up to 1.27.9. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 5, 2026The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin forCVE-2025-11370 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'store' function of the RulesAjaxController class in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to update pop-up display settings.
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 5, 2026The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-23511 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows DOM-Based XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.3.3.
Product
The Plus Addons for Elementor Page Builder Lite
Affected
up to 5.3.3
What to do
Affects up to 5.3.3. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2026ShopBuilder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13456 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
ShopBuilder
Fixed in
3.2.2
What to do
Update ShopBuilder to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Dec 31, 2025Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30628 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.
Product
Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.2
What to do
Affects up to 1.2. Update Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Livemesh Addons for Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62990 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Beaver Builder addons-for-beaver-builder allows Stored XSS.This issue affects Livemesh Addons for Beaver Builder: from n/a through <= 3.9.2.
Product
Livemesh Addons for Beaver Builder
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update Livemesh Addons for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Web and WooCommerce Addons for WPBakery Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62748 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genetech Products Web and WooCommerce Addons for WPBakery Builder vc-addons-by-bit14 allows DOM-Based XSS.This issue affects Web and WooCommerce Addons for WPBakery Builder: from n/a through <= 1.5.
Product
Web and WooCommerce Addons for WPBakery Builder
Affected
up to 1.5
What to do
Affects up to 1.5. Update Web and WooCommerce Addons for WPBakery Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Knowband Mobile App Builder: Does not have authorisationCVE-2025-13029 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.
Product
Knowband Mobile App Builder
Fixed in
3.0.0
What to do
Update Knowband Mobile App Builder to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 29, 2025Mobile builder: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-68860 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through <= 1.4.2.
Product
Mobile builder
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Page Builder: Live Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22.
Product
Page Builder: Live Composer
Affected
up to 2.1.22
What to do
Affects up to 2.1.22. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025YITH Slider for page builders: Missing AuthorizationCVE-2025-68581 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH Slider for page builders: from n/a through <= 1.0.11.
Product
YITH Slider for page builders
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update YITH Slider for page builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025WC Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68533 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS.This issue affects WC Builder: from n/a through <= 1.2.0.
Product
WC Builder
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WC Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 23, 2025Beaver Builder – WordPress Page Builder: Unauthorized access and modification of dataCVE-2025-12934 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'duplicate_wpml_layout' function in all versions up to, and including, 2.9.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary posts with the content of other existing posts, potentially exposing private and password-protected content and deleting any content that is not saved in revisions or backups. Posts must have been created with Beaver Builder to be copied or updated.
Product
Beaver Builder – WordPress Page Builder
Affected
up to 2.9.4.1
What to do
Affects up to 2.9.4.1. Update Beaver Builder – WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 22, 2025Void Elementor WHMCS Elements For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62094 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidthemes Void Elementor WHMCS Elements For Elementor Page Builder void-elementor-whmcs-elements.This issue affects Void Elementor WHMCS Elements For Elementor Page Builder: from n/a through <= 2.0.1.2.
Product
Void Elementor WHMCS Elements For Elementor Page Builder
Affected
up to 2.0.1.2
What to do
Affects up to 2.0.1.2. Update Void Elementor WHMCS Elements For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 20, 2025Live Composer – Free WordPress Website Builder: PHP Object InjectionCVE-2025-14071 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via deserialization of untrusted input in the dslc_module_posts_output shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Live Composer – Free WordPress Website Builder
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Live Composer – Free WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 20, 2025WC Builder – WooCommerce Page Builder for WPBakery: Stored Cross-Site ScriptingCVE-2025-14054 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'heading_color' parameter (and multiple other styling parameters) of the `wpbforwpbakery_product_additional_information` shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WC Builder – WooCommerce Page Builder for WPBakery
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WC Builder – WooCommerce Page Builder for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2025There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to potentCVE-2025-67712 · Other software · Esri · reported by psirt@esri.comMedium 4.7
There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to potentially entice a user to click a link that causes arbitrary HTML to render in a victim's browser. There is no evidence of JavaScript execution, which limits the impact. At the time of submission, ArcGIS Web App Builder developer edition is retired and unsupported. ArcGIS Web App Builder 2.30 is not susceptible to this vulnerability.
Product
ArcGIS Web AppBuilder {Developer Edition)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.esri.com mdronski.pl
Dec 19, 2025Colibri Page Builder: Stored Cross-Site ScriptingCVE-2025-11747 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibri_blog_posts shortcode in all versions up to, and including, 1.0.345 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Colibri Page Builder
Affected
up to 1.0.345
What to do
Affects up to 1.0.345. Update Colibri Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025PDF for Elementor Forms + Drag And Drop Template Builder: Deserialization of Untrusted DataCVE-2025-60084 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
Product
PDF for Elementor Forms + Drag And Drop Template Builder
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF for Elementor Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF Invoice Builder for WooCommerce: Deserialization of Untrusted DataCVE-2025-60083 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
Product
PDF Invoice Builder for WooCommerce
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF for Gravity Forms + Drag And Drop Template Builder: Deserialization of Untrusted DataCVE-2025-60080 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
Product
PDF for Gravity Forms + Drag And Drop Template Builder
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF for Gravity Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 17, 2025Live Composer – Free WordPress Website Builder: Multiple Stored Cross-Site Scripting vulnerabilitiesCVE-2025-13537 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to multiple Stored Cross-Site Scripting vulnerabilities via DOM manipulation in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Live Composer – Free WordPress Website Builder
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Live Composer – Free WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2025Ninja Forms – The Contact Form Builder That Grows With You: Insecure Direct Object ReferenceCVE-2025-11924 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.
Product
Ninja Forms – The Contact Form Builder That Grows With You
Affected
up to 3.13.2
What to do
Affects up to 3.13.2. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2025Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns: Unauthorized access of dataCVE-2025-11369 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback and get_siteinfo functions in all versions up to, and including, 5.7.2. This makes it possible for authenticated attackers, with Author-level access and above, to view API keys configured for the external services.
Product
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2025SKT Page Builder: Missing AuthorizationCVE-2025-54005 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SKT Page Builder: from n/a through <= 4.9.
Product
SKT Page Builder
Affected
up to 4.9
What to do
Affects up to 4.9. Update SKT Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025JetFormBuilder — Dynamic Blocks Form Builder: Unauthorized modification of dataCVE-2025-11991 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update JetFormBuilder — Dynamic Blocks Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress isCVE-2025-13367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.