Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

222 results · page 2 of 5

Sep 22, 2025Dashboard Notepad: Cross-Site Request Forgery (CSRF)CVE-2025-57927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stephanie Leary Dashboard Notepad dashboard-notepad allows Cross Site Request Forgery.This issue affects Dashboard Notepad: from n/a through <= 1.42.
Product
Dashboard Notepad
Affected
up to 1.42
What to do
Affects up to 1.42. Update Dashboard Notepad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Material Dashboard: Weak Password Recovery Mechanism for Forgotten PasswordCVE-2025-32486 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: from n/a through <= 1.4.6.
Product
Material Dashboard
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Dashboard Widget Sidebar: Missing AuthorizationCVE-2025-53293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through <= 1.2.3.
Product
Dashboard Widget Sidebar
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Dashboard Widget Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 12, 2025WP Sliding Login/Dashboard Panel: Cross-Site Request ForgeryCVE-2025-5928 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Sliding Login/Dashboard Panel
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update WP Sliding Login/Dashboard Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2025Frontend Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through <= 2.2.8.
Product
Frontend Dashboard
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 30, 2025Gearside Developer Dashboard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-4429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Gearside Developer Dashboard
Affected
up to 1.0.72
What to do
Affects up to 1.0.72. Update Gearside Developer Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025WP Dashboard Notes: Does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX actionCVE-2023-7239 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.
Product
WP Dashboard Notes
Fixed in
1.0.11
What to do
Update WP Dashboard Notes to 1.0.11 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Remote Code ExecutionCVE-2025-3053 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uip_process_form_input() function. This is due to the function taking user supplied inputs to execute arbitrary functions with arbitrary data, and does not have any sort of capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.07
What to do
Affects up to 3.5.07. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 13, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4474 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting_form_function() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin’s 'register' role setting to make new user registrations default to the administrator role, leading to an elevation of privileges to that of an administrator.
Product
Frontend Dashboard
Affected
1.0 to 2.2.7
What to do
Affects 1.0 to 2.2.7. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4473 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to control where the plugin sends outgoing emails. By pointing SMTP to their own server, attackers could capture password reset emails intended for administrators, and elevate their privileges for full site takeover.
Product
Frontend Dashboard
Affected
1.0 to 2.2.7
What to do
Affects 1.0 to 2.2.7. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 7, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4104 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator.
Product
Frontend Dashboard
Affected
1.0 to 2.2.6
What to do
Affects 1.0 to 2.2.6. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2025Frontend Dashboard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46248 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows SQL Injection.This issue affects Frontend Dashboard: from n/a through <= 2.2.5.
Product
Frontend Dashboard
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Dashboard Notepads: Cross-Site Request Forgery (CSRF)CVE-2025-39441 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Dashboard Notepads dashboard-notepads allows Stored XSS.This issue affects Dashboard Notepads: from n/a through <= 1.2.1.
Product
Dashboard Notepads
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Dashboard Notepads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025WordPress Dashboard Tweeter: Missing AuthorizationCVE-2025-23906 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wpseek WordPress Dashboard Tweeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress Dashboard Tweeter: from n/a through 1.3.2.
Product
WordPress Dashboard Tweeter
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WordPress Dashboard Tweeter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1525 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ultimate Dashboard
Fixed in
3.8.6
What to do
Update Ultimate Dashboard to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1524 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ultimate Dashboard
Fixed in
3.8.6
What to do
Update Ultimate Dashboard to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1523 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ultimate Dashboard
Fixed in
3.8.6
What to do
Update Ultimate Dashboard to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com
Apr 11, 2025Material Dashboard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31014 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
Product
Material Dashboard
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025ShareThis Dashboard for Google Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-32282 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ShareThis ShareThis Dashboard for Google Analytics googleanalytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a through <= 3.2.3.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Chamber Dashboard Business Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32162 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Morgan Kay Chamber Dashboard Business Directory allows DOM-Based XSS. This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.11.
Product
Chamber Dashboard Business Directory
Affected
up to 3.3.11
What to do
Affects up to 3.3.11. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Material Dashboard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31097 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
Product
Material Dashboard
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Material Dashboard: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31095 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Hossein Material Dashboard material-dashboard allows Authentication Bypass.This issue affects Material Dashboard: from n/a through <= 1.4.5.
Product
Material Dashboard
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2025Ultimate Dashboard – Custom WordPress Dashboard: Unauthorized modification of dataCVE-2025-2276 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_module_actions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules.
Product
Ultimate Dashboard – Custom WordPress Dashboard
Affected
up to 3.8.7
What to do
Affects up to 3.8.7. Update Ultimate Dashboard – Custom WordPress Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2025ShareThis Dashboard for Google Analytics: Unauthorized modification of dataCVE-2025-1507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_actions() function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all features.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2025Custom Dashboard Page: Cross-Site Request Forgery (CSRF)CVE-2025-28912 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through <= 1.0.
Product
Custom Dashboard Page
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Dashboard Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 7, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of data that can lead to privilege escalationCVE-2025-1309 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the uip_save_form_as_option() function in all versions up to, and including, 3.5.04. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.04
What to do
Affects up to 3.5.04. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2025System Dashboard: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26911 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.
Product
System Dashboard
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2025C9 Admin Dashboard: Stored Cross-Site ScriptingCVE-2024-13379 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The C9 Admin Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
C9 Admin Dashboard
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update C9 Admin Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025ADFO – Custom data in admin dashboard: Stored Cross-Site ScriptingCVE-2024-13390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adfo_list' shortcode in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ADFO – Custom data in admin dashboard
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update ADFO – Custom data in admin dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 14, 2025Kv Compose Email From Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23525 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha Kv Compose Email From Dashboard kv-send-email-from-admin allows Reflected XSS.This issue affects Kv Compose Email From Dashboard: from n/a through <= 1.1.
Product
Kv Compose Email From Dashboard
Affected
up to 1.1
What to do
Affects up to 1.1. Update Kv Compose Email From Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Live Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23474 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mike Martel Live Dashboard live-dashboard allows Reflected XSS.This issue affects Live Dashboard: from n/a through <= 0.3.3.
Product
Live Dashboard
Affected
up to 0.3.3
What to do
Affects up to 0.3.3. Update Live Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Custom Links On Admin Dashboard Toolbar: Cross-Site Request Forgery (CSRF)CVE-2025-25135 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Victor Barkalov Custom Links On Admin Dashboard Toolbar customize-wpadmin allows Stored XSS.This issue affects Custom Links On Admin Dashboard Toolbar: from n/a through <= 3.3.
Product
Custom Links On Admin Dashboard Toolbar
Affected
up to 3.3
What to do
Affects up to 3.3. Update Custom Links On Admin Dashboard Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 30, 2025System Dashboard: Reflected Cross-Site ScriptingCVE-2024-12299 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Product
System Dashboard
Affected
up to 2.8.17
What to do
Affects up to 2.8.17. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2025FLX Dashboard Groups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23730 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flx0 FLX Dashboard Groups flx-dashboard-groups allows Reflected XSS.This issue affects FLX Dashboard Groups: from n/a through <= 0.0.7.
Product
FLX Dashboard Groups
Affected
up to 0.0.7
What to do
Affects up to 0.0.7. Update FLX Dashboard Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Chamber Dashboard Business Directory: Missing AuthorizationCVE-2025-23917 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Chandrika Guntur, Morgan Kay Chamber Dashboard Business Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.8.
Product
Chamber Dashboard Business Directory
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Chamber Dashboard Business Directory: Stored Cross-Site ScriptingCVE-2024-11452 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'business_categories' shortcode in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Chamber Dashboard Business Directory
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025Custom Dashboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56024 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Reflected XSS.This issue affects Custom Dashboard Widget: from n/a through <= 1.0.0.
Product
Custom Dashboard Widget
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Custom Dashboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Simple Dashboard: Incorrect Privilege AssignmentCVE-2024-56071 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in mikeleembruggen Simple Dashboard simple-dashboard allows Privilege Escalation.This issue affects Simple Dashboard: from n/a through <= 2.0.
Product
Simple Dashboard
Affected
up to 2.0
What to do
Affects up to 2.0. Update Simple Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites: Privilege escalationCVE-2024-10783 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.
Product
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
Affected
up to 5.2
What to do
Affects up to 5.2. Update MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 10, 2024System Dashboard: Does not sanitise and escape some parametersCVE-2024-11107 · WordPress plugins & themes · reported by WPScanMedium 6.1
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
Product
System Dashboard
Fixed in
2.8.15
What to do
Update System Dashboard to 2.8.15 or newer.
Full record and what to do →NVD record wpscan.com
Dec 10, 2024System Dashboard: Does not validate user input used in a pathCVE-2024-10708 · WordPress plugins & themes · reported by WPScanMedium 4.9
The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server
Product
System Dashboard
Fixed in
2.8.15
What to do
Update System Dashboard to 2.8.15 or newer.
Full record and what to do →NVD record wpscan.com
Nov 19, 2024Custom Dashboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51860 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Stored XSS.This issue affects Custom Dashboard Widget: from n/a through <= 1.0.0.
Product
Custom Dashboard Widget
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Custom Dashboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2024-43338 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through <= 3.1.3.
Product
Crowdsignal Dashboard – Polls, Surveys & more
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2024WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer: Stored Cross-Site ScriptingCVE-2024-8959 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer
Affected
up to 4.0.1.6
What to do
Affects up to 4.0.1.6. Update WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 16, 2024MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance: Stored Cross-Site ScriptingCVE-2016-15041 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record klikki.fi web.archive.org
Oct 11, 2024Download Plugins and Themes in ZIP from Dashboard: Reflected Cross-Site ScriptingCVE-2024-9232 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Download Plugins and Themes in ZIP from Dashboard
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2024Frontend Dashboard: Unauthorized code executionCVE-2024-8268 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords.
Product
Frontend Dashboard
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2024Dark Mode for WP Dashboard: Cross-Site Request Forgery (CSRF)CVE-2024-43325 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3.
Product
Dark Mode for WP Dashboard
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Dark Mode for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 16, 2024Download Plugins and Themes in ZIP from Dashboard: Cross-Site Request ForgeryCVE-2024-7501 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the download_theme() function. This makes it possible for unauthenticated attackers to download arbitrary themes from the website via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. In versions prior to 1.8.6 it was possible to download the entire sites files.
Product
Download Plugins and Themes in ZIP from Dashboard
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 12, 2024WP Dashboard Notes: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43226 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jeroen Sormani WP Dashboard Notes allows Stored XSS.This issue affects WP Dashboard Notes: from n/a through 1.0.11.
Product
WP Dashboard Notes
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update WP Dashboard Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.