Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

145 results · page 2 of 3

Jul 10, 2026OAuth Single Sign On - SSO (OAuth Client): Authentication Bypass Using an Alternate Path or ChannelCVE-2026-57807 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.
Product
OAuth Single Sign On - SSO (OAuth Client)
Affected
up to 38.5.8
What to do
Affects up to 38.5.8. Update OAuth Single Sign On - SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 10, 2026Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for: Stored Cross-Site ScriptingCVE-2026-13247 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lgx_tooltip_position' parameter in all versions up to, and including, 5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for
Affected
up to 5.5
What to do
Affects up to 5.5. Update Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2026CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.CVE-2026-40724 · WordPress plugins & themes · reported by PatchstackMedium 6.5
CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.
Affected
up to 5.6.2
What to do
Affects up to 5.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2026ProSolution WP Client: Arbitrary File UploadCVE-2026-6555 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file.
Product
ProSolution WP Client
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update ProSolution WP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2026HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uCVE-2020-37227 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can intercept upload requests to the logoupload parameter in the admin interface and rename files to executable extensions .php to achieve remote code execution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record ms.wordpress.org exploit-db.com
Apr 8, 2026ProSolution WP Client: Arbitrary file uploadsCVE-2026-2942 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol_fileUploadProcess' function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
ProSolution WP Client
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update ProSolution WP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-39562 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.10
What to do
Affects up to 20.8.10. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 21, 2026Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider: Stored Cross-Site ScriptingCVE-2026-0609 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt text in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping in the 'logo-slider' shortcode. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider
Affected
up to 4.9.0
What to do
Affects up to 4.9.0. Update Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026Sprout Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through <= 3.2.2.
Product
Sprout Clients
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Sprout Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Client Invoicing by Sprout Invoices: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32401 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows PHP Local File Inclusion.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.9.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.9
What to do
Affects up to 20.8.9. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Client Testimonial Slider: Stored Cross-Site ScriptingCVE-2026-2716 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Testimonial Heading' setting in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Client Testimonial Slider
Affected
up to 2.0
What to do
Affects up to 2.0. Update Client Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-25364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.8
What to do
Affects up to 20.8.8. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Client Portal: Missing AuthorizationCVE-2026-25003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in madalin.ungureanu Client Portal client-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Portal: from n/a through <= 1.2.1.
Product
Client Portal
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2026WPNakama – Team and multi-Client Collaboration, Editorial and Project Management: SQL InjectionCVE-2026-2495 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the '/wp-json/WPNakama/v1/boards' REST API endpoint in all versions up to, and including, 0.6.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPNakama – Team and multi-Client Collaboration, Editorial and Project Management
Affected
up to 0.6.5
What to do
Affects up to 0.6.5. Update WPNakama – Team and multi-Client Collaboration, Editorial and Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2026OAuth Single Sign On – SSO (OAuth Client): Unauthorized accessCVE-2025-10753 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality accessible via the 'oauthredirect' option parameter. This makes it possible for unauthenticated attackers to set the global redirect URL option via the redirect_url parameter granted they can access the site directly.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.26.14
What to do
Affects up to 6.26.14. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 17, 2026Spin Wheel: Client-side prize manipulationCVE-2026-0808 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.
Product
Spin Wheel
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Spin Wheel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Client Testimonial Slider: Stored Cross-Site ScriptingCVE-2025-13897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aft_testimonial_meta_name' custom field in the Client Information metabox in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected administrative page.
Product
Client Testimonial Slider
Affected
up to 2.0
What to do
Affects up to 2.0. Update Client Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 31, 2025Logo Slider , Logo Carousel , Logo showcase , Client Logo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62121 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Logo Slider , Logo Carousel , Logo showcase , Client Logo tc-logo-slider allows Stored XSS.This issue affects Logo Slider , Logo Carousel , Logo showcase , Client Logo: from n/a through <= 1.8.1.
Product
Logo Slider , Logo Carousel , Logo showcase , Client Logo
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Logo Slider , Logo Carousel , Logo showcase , Client Logo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025OpenID Connect Generic Client: Stored Cross-Site ScriptingCVE-2025-13730 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The OpenID Connect Generic Client plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'openid_connect_generic_auth_url' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
OpenID Connect Generic Client
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update OpenID Connect Generic Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025Sprout Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66118 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affects Sprout Clients: from n/a through <= 3.2.1.
Product
Sprout Clients
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Sprout Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Client Invoicing by Sprout Invoices: Deserialization of Untrusted DataCVE-2025-64227 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.7
What to do
Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2025-64229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.7
What to do
Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 3, 2025OAuth Single Sign On – SSO (OAuth Client): Improper Verification of Cryptographic SignatureCVE-2025-9485 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.26.12
What to do
Affects up to 6.26.12. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2025OAuth Single Sign On – SSO (OAuth Client): Cross-Site Request ForgeryCVE-2025-10752 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.26.12
What to do
Affects up to 6.26.12. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025Propovoice: All-in-One Client Management System: Arbitrary File ReadCVE-2025-8422 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Propovoice: All-in-One Client Management System
Affected
up to 1.7.6.7
What to do
Affects up to 1.7.6.7. Update Propovoice: All-in-One Client Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2025Ultimate Client Dash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58811 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Ultimate Client Dash ulimate-client-dash allows Stored XSS.This issue affects Ultimate Client Dash: from n/a through <= 4.7.
Product
Ultimate Client Dash
Affected
up to 4.7
What to do
Affects up to 4.7. Update Ultimate Client Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 4, 2025Sunshine Photo Cart: Free Client Photo Galleries for Photographers: Privilege escalationCVE-2025-5482 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords through the password reset functionality, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
Sunshine Photo Cart: Free Client Photo Galleries for Photographers
Affected
up to 3.4.11
What to do
Affects up to 3.4.11. Update Sunshine Photo Cart: Free Client Photo Galleries for Photographers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2025This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to maniCVE-2024-0970 · WordPress plugins & themes · reported by WPScanMedium 5.3
This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
Fixed in
4.1.4
What to do
Update the plugin to 4.1.4 or newer.
Full record and what to do →NVD record wpscan.com
May 2, 2025FULL – Cliente: SQL InjectionCVE-2024-12023 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the PRO version of the plugin is activated, along with Elementor Pro and Elementor CRM.
Product
FULL – Cliente
What to do
Update FULL – Cliente to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 1, 2025KiwiChat NextClient: Stored Cross-Site ScriptingCVE-2025-3670 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The KiwiChat NextClient plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
KiwiChat NextClient
Affected
up to 6.2
What to do
Affects up to 6.2. Update KiwiChat NextClient to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 17, 2025Clinked Client Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32615 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clinked Clinked Client Portal clinked-client-portal allows Reflected XSS.This issue affects Clinked Client Portal: from n/a through <= 1.10.
Product
Clinked Client Portal
Affected
up to 1.10
What to do
Affects up to 1.10. Update Clinked Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025Clients: Missing AuthorizationCVE-2025-31746 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Think201 Clients clients allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clients: from n/a through <= 1.1.4.
Product
Clients
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Sprout Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31797 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through <= 3.2.
Product
Sprout Clients
Affected
up to 3.2
What to do
Affects up to 3.2. Update Sprout Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Client Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31737 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dxladner Client Showcase client-showcase allows Stored XSS.This issue affects Client Showcase: from n/a through <= 1.2.0.
Product
Client Showcase
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Client Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 18, 2025The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: Arbitrary shortcode executionCVE-2025-2262 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.7.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 4, 2025Admin and Site Enhancements (ASE): Retrieves client IP addresses from potentially untrusted headersCVE-2024-13685 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.
Product
Admin and Site Enhancements (ASE)
Fixed in
7.6.10
What to do
Update Admin and Site Enhancements (ASE) to 7.6.10 or newer.
Full record and what to do →NVD record wpscan.com
Feb 28, 2025WHMPress - WHMCS Client Area: Unauthorized modification of data that can lead to privilege escalationCVE-2024-9195 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the update_settings case in the /admin/ajax.php file in all versions up to, and including, 4.3-revision-3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WHMPress - WHMCS Client Area
Affected
up to 4.3-revision-3
What to do
Affects up to 4.3-revision-3. Update WHMPress - WHMCS Client Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not have CSRF check in some placesCVE-2024-13115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
WP Projects Portfolio with Client Testimonials
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13114 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Projects Portfolio with Client Testimonials
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 30, 2025Clinked Client Portal: Stored Cross-Site ScriptingCVE-2024-12524 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Clinked Client Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'clinked-login-button' shortcode in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Clinked Client Portal
Affected
up to 1.9
What to do
Affects up to 1.9. Update Clinked Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2025Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2025-24606 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.1.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.1
What to do
Affects up to 20.8.1. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Free MailClient FMC: Cross-Site Request Forgery (CSRF)CVE-2025-23703 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in cstoltenkamp Free MailClient FMC mailclient allows Stored XSS.This issue affects Free MailClient FMC: from n/a through <= 1.0.
Product
Free MailClient FMC
Affected
up to 1.0
What to do
Affects up to 1.0. Update Free MailClient FMC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2025InfiniteWP Client: Path TraversalCVE-2024-10585 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory.
Product
InfiniteWP Client
Affected
up to 1.13.0
What to do
Affects up to 1.13.0. Update InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Dec 13, 2024Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54245 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through <= 1.1.4.
Product
Clients
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 11, 2024OAuth Single Sign On – SSO (OAuth Client): Authentication bypassCVE-2024-10111 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.26.3
What to do
Affects up to 6.26.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 9, 2024Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2024-53819 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.0.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.0
What to do
Affects up to 20.8.0. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024WE – Client Logo Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51821 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordpresteem WE – Client Logo Carousel we-client-logo-carousel allows Stored XSS.This issue affects WE – Client Logo Carousel: from n/a through <= 1.4.
Product
WE – Client Logo Carousel
Affected
up to 1.4
What to do
Affects up to 1.4. Update WE – Client Logo Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Client Power Tools Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Glover Client Power Tools Portal client-power-tools allows Reflected XSS.This issue affects Client Power Tools Portal: from n/a through <= 1.9.0.
Product
Client Power Tools Portal
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Client Power Tools Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2024FULL – Cliente: Reflected Cross-Site ScriptingCVE-2024-9211 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FULL – Cliente plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.22. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
FULL – Cliente
Affected
up to 3.1.22
What to do
Affects up to 3.1.22. Update FULL – Cliente to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 5, 2024Logo Carousel – Clients logo carousel for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel – Clients logo carousel for WP: from n/a through <= 1.2.
Product
Logo Carousel – Clients logo carousel for WP
Affected
up to 1.2
What to do
Affects up to 1.2. Update Logo Carousel – Clients logo carousel for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.