Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,460entries in the database

15,923 results · page 160 of 319

Jan 26, 2025Survey Maker: Stored Cross-Site ScriptingCVE-2024-13505 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Survey Maker
Affected
up to 5.1.3.3
What to do
Affects up to 5.1.3.3. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2025WC Affiliate – A Complete WooCommerce Affiliate: Reflected Cross-Site ScriptingCVE-2024-12334 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WC Affiliate – A Complete WooCommerce Affiliate
Affected
up to 2.4
What to do
Affects up to 2.4. Update WC Affiliate – A Complete WooCommerce Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2025VikBooking Hotel Booking Engine & PMS: Cross-Site Request ForgeryCVE-2024-11641 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2025Quiz Maker Business, Developer, and Agency: Reflected Cross-Site ScriptingCVE-2024-10636 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Quiz Maker Business, Developer, and Agency
Affected
up to 8.8.0
What to do
Affects up to 8.8.0. Update Quiz Maker Business, Developer, and Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ays-pro.com ays-pro.com
Jan 25, 2025Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More: Stored Cross-Site ScriptingCVE-2025-0350 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-13599 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to insufficient input sanitization and output escaping of a lesson name. This makes it possible for authenticated attackers, with LP Instructor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.7.5
What to do
Affects up to 4.2.7.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 25, 2025Masy Gallery: Stored Cross-Site ScriptingCVE-2024-13586 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Masy Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'justified-gallery' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Masy Gallery
Affected
up to 1.7
What to do
Affects up to 1.7. Update Masy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 25, 2025ABC Notation: Stored Cross-Site ScriptingCVE-2024-13551 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ABC Notation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abcjs' shortcode in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ABC Notation
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update ABC Notation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Jan 25, 2025Power Ups for Elementor: Stored Cross-Site ScriptingCVE-2024-13548 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Power Ups for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'magic-button' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Power Ups for Elementor
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Power Ups for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 25, 2025WP Contact Form7 Email Spam Blocker: Reflected Cross-Site ScriptingCVE-2024-13467 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Contact Form7 Email Spam Blocker
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Contact Form7 Email Spam Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 25, 2025WordPress SEO Friendly Accordion FAQ with AI assisted content generation: Stored Cross-Site ScriptingCVE-2024-13458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress SEO Friendly Accordion FAQ with AI assisted content generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'noticefaq' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress SEO Friendly Accordion FAQ with AI assisted content generation
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WordPress SEO Friendly Accordion FAQ with AI assisted content generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 25, 2025Bilingual Linker: Stored Cross-Site ScriptingCVE-2024-13441 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bilingual Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bl_otherlang_link_1 parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bilingual Linker
Affected
up to 2.4
What to do
Affects up to 2.4. Update Bilingual Linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025Etsy Importer: Stored Cross-Site ScriptingCVE-2024-12817 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Etsy Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_link' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Etsy Importer
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Etsy Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 25, 2025NOTICE BOARD BY TOWKIR: Stored Cross-Site ScriptingCVE-2024-12816 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NOTICE BOARD BY TOWKIR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'notice-board' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
NOTICE BOARD BY TOWKIR
Affected
up to 3.1
What to do
Affects up to 3.1. Update NOTICE BOARD BY TOWKIR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 25, 2025brodos.net Onlineshop: Stored Cross-Site ScriptingCVE-2024-12529 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The brodos.net Onlineshop Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'BrodosCategory' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
brodos.net Onlineshop
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update brodos.net Onlineshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 25, 2025Ask Me Anything (Anonymously): Stored Cross-Site ScriptingCVE-2024-12512 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ask Me Anything (Anonymously) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'askmeanythingpeople' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ask Me Anything (Anonymously)
Affected
up to 1.6
What to do
Affects up to 1.6. Update Ask Me Anything (Anonymously) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 25, 2025Target Video Easy Publish: Cross-Site Request ForgeryCVE-2024-12076 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Target Video Easy Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the resync_carousel(), seek_snapshot(), uploaded_cc(), and remove_cc() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Target Video Easy Publish
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025Broadstreet: Stored Cross-Site ScriptingCVE-2024-11825 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘zone’ parameter in all versions up to, and including, 1.51.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Broadstreet
Affected
up to 1.51.0
What to do
Affects up to 1.51.0. Update Broadstreet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025Flexmls® IDX: Stored Cross-Site ScriptingCVE-2024-10552 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘api_key’ and 'api_secret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 3.14.25.
Product
Flexmls® IDX
Affected
up to 3.14.26
What to do
Affects up to 3.14.26. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025Plethora Plugins Tabs + Accordions: Stored Cross-Site ScriptingCVE-2024-13721 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Plethora Plugins Tabs + Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the anchor parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Plethora Plugins Tabs + Accordions
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Plethora Plugins Tabs + Accordions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2025Linear: Cross-Site Request ForgeryCVE-2024-13709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Linear plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on the 'linear-debug'. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Linear
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Linear to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2025Roi Calculator: Cross-Site Request Forgery (CSRF)CVE-2025-24756 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mgplugin Roi Calculator roi-calculator allows Stored XSS.This issue affects Roi Calculator: from n/a through <= 1.0.
Product
Roi Calculator
Affected
up to 1.0
What to do
Affects up to 1.0. Update Roi Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025PDF Invoice Builder for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24755 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Stored XSS.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 4.6.0.
Product
PDF Invoice Builder for WooCommerce
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Popup Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24746 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Iser Popup Maker popup-maker allows Stored XSS.This issue affects Popup Maker: from n/a through <= 1.20.2.
Product
Popup Maker
Affected
up to 1.20.2
What to do
Affects up to 1.20.2. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025FluentSMTP: Cross-Site Request Forgery (CSRF)CVE-2025-24739 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel FluentSMTP fluent-smtp allows Cross Site Request Forgery.This issue affects FluentSMTP: from n/a through <= 2.2.80.
Product
FluentSMTP
Affected
up to 2.2.80
What to do
Affects up to 2.2.80. Update FluentSMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Call Now Button: Cross-Site Request Forgery (CSRF)CVE-2025-24738 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jerry Rietveld Call Now Button call-now-button allows Cross Site Request Forgery.This issue affects Call Now Button: from n/a through <= 1.4.13.
Product
Call Now Button
Affected
up to 1.4.13
What to do
Affects up to 1.4.13. Update Call Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025BookingPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24732 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows DOM-Based XSS.This issue affects BookingPress: from n/a through <= 1.1.25.
Product
BookingPress
Affected
up to 1.1.25
What to do
Affects up to 1.1.25. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Download IP2Location Country Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24731 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IP2Location Download IP2Location Country Blocker ip2location-country-blocker allows Stored XSS.This issue affects Download IP2Location Country Blocker: from n/a through <= 2.38.3.
Product
Download IP2Location Country Blocker
Affected
up to 2.38.3
What to do
Affects up to 2.38.3. Update Download IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025WP VR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24730 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.14.
Product
WP VR
Affected
up to 8.5.14
What to do
Affects up to 8.5.14. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24729 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.3.
Product
ElementInvader Addons for Elementor
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Contact Form Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24727 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through <= 1.3.52.
Product
Contact Form Email
Affected
up to 1.3.52
What to do
Affects up to 1.3.52. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025HT Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24726 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 1.2.1.
Product
HT Contact Form 7
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update HT Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Side Menu Lite: Cross-Site Request Forgery (CSRF)CVE-2025-24724 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite side-menu-lite allows Cross Site Request Forgery.This issue affects Side Menu Lite: from n/a through <= 5.3.1.
Product
Side Menu Lite
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Side Menu Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Booking Calendar Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24723 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.55.
Product
Booking Calendar Contact Form
Affected
up to 1.2.55
What to do
Affects up to 1.2.55. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025FAQ Builder AYS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24722 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Stored XSS.This issue affects FAQ Builder AYS: from n/a through <= 1.7.3.
Product
FAQ Builder AYS
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update FAQ Builder AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Easy YouTube Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24721 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Easy YouTube Gallery easy-youtube-gallery allows Stored XSS.This issue affects Easy YouTube Gallery: from n/a through <= 1.0.4.
Product
Easy YouTube Gallery
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Easy YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Sticky Buttons: Cross-Site Request Forgery (CSRF)CVE-2025-24720 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Sticky Buttons sticky-buttons allows Cross Site Request Forgery.This issue affects Sticky Buttons: from n/a through <= 4.1.1.
Product
Sticky Buttons
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Sticky Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Widget Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24719 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored XSS.This issue affects Widget Countdown: from n/a through <= 2.7.1.
Product
Widget Countdown
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Widget Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Modal Window: Cross-Site Request Forgery (CSRF)CVE-2025-24717 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window modal-window allows Cross Site Request Forgery.This issue affects Modal Window: from n/a through <= 6.1.4.
Product
Modal Window
Affected
up to 6.1.4
What to do
Affects up to 6.1.4. Update Modal Window to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Herd Effects: Cross-Site Request Forgery (CSRF)CVE-2025-24716 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Herd Effects mwp-herd-effect allows Cross Site Request Forgery.This issue affects Herd Effects: from n/a through <= 6.2.1.
Product
Herd Effects
Affected
up to 6.2.1
What to do
Affects up to 6.2.1. Update Herd Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Counter Box: Cross-Site Request Forgery (CSRF)CVE-2025-24715 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box counter-box allows Cross Site Request Forgery.This issue affects Counter Box: from n/a through <= 2.0.5.
Product
Counter Box
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Counter Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Bubble Menu – circle floating menu: Cross-Site Request Forgery (CSRF)CVE-2025-24714 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu bubble-menu allows Cross Site Request Forgery.This issue affects Bubble Menu – circle floating menu: from n/a through <= 4.0.2.
Product
Bubble Menu – circle floating menu
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Bubble Menu – circle floating menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Button Generator – easily Button Builder: Cross-Site Request Forgery (CSRF)CVE-2025-24713 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.This issue affects Button Generator – easily Button Builder: from n/a through <= 3.1.1.
Product
Button Generator – easily Button Builder
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Button Generator – easily Button Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Radius Blocks: Cross-Site Request Forgery (CSRF)CVE-2025-24712 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Radius Blocks radius-blocks allows Cross Site Request Forgery.This issue affects Radius Blocks: from n/a through <= 2.1.2.
Product
Radius Blocks
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Radius Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Popup Box: Cross-Site Request Forgery (CSRF)CVE-2025-24711 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Popup Box popup-box allows Cross Site Request Forgery.This issue affects Popup Box: from n/a through <= 3.2.4.
Product
Popup Box
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Popup Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Plethora Plugins Tabs + Accordions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plethora Plugins Plethora Plugins Tabs + Accordions plethora-tabs-accordions allows Stored XSS.This issue affects Plethora Plugins Tabs + Accordions: from n/a through <= 1.1.5.
Product
Plethora Plugins Tabs + Accordions
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Plethora Plugins Tabs + Accordions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025MultiVendorX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24706 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.13.
Product
MultiVendorX
Affected
up to 4.2.13
What to do
Affects up to 4.2.13. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Magic the Gathering Card Tooltips: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24704 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through <= 3.4.0.
Product
Magic the Gathering Card Tooltips
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Magic the Gathering Card Tooltips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Xagio SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24702 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xagio SEO Xagio SEO xagio-seo allows Stored XSS.This issue affects Xagio SEO: from n/a through <= 7.0.0.20.
Product
Xagio SEO
Affected
up to 7.0.0.20
What to do
Affects up to 7.0.0.20. Update Xagio SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Essential Real Estate: Cross-Site Request Forgery (CSRF)CVE-2025-24698 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in g5theme Essential Real Estate essential-real-estate allows Cross Site Request Forgery.This issue affects Essential Real Estate: from n/a through <= 5.1.8.
Product
Essential Real Estate
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.