Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

178 results · page 2 of 4

May 7, 2026WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance: Arbitrary file deletionCVE-2026-7252 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.
Product
WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance
Affected
up to 4.5.2
What to do
Affects up to 4.5.2. Update WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 6, 2026Ninja Tables – Easy Data Table Builder: Unauthorized database table creationCVE-2026-2306 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on the `createFluentCartTable` function in all versions up to, and including, 5.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary Ninja Tables in the database which can lead to database pollution and resource exhaustion.
Product
Ninja Tables – Easy Data Table Builder
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update Ninja Tables – Easy Data Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 5, 2026WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database bacCVE-2023-54346 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record backupbliss.com downloads.wordpress.org
Apr 9, 2026WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queriesCVE-2023-54359 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org adivaha.com
Mar 31, 2026Database for Contact Form 7, WPforms, Elementor forms: Unauthorized access of dataCVE-2026-3831 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 5, 2026Database for Contact Form 7, WPforms, Elementor forms: PHP Object InjectionCVE-2026-2599 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Authorization bypassCVE-2026-0825 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnerability is created because while the shortcode properly filters displayed entries by user, the CSV export handler completely bypasses this filtering and exports all entries regardless of user permissions.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 13, 2026Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries.CVE-2023-54333 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted POST requests with malicious SQL payloads to retrieve and potentially steal entire database contents.
Product
Social-Share-Buttons
What to do
Update Social-Share-Buttons to the newest version.
Full record and what to do →NVD record github.com supsystic.com
Jan 7, 2026Advanced Database Cleaner PRO: Path Traversal: '.../...//'CVE-2025-46256 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO: from n/a through 3.2.10.
Product
Advanced Database Cleaner PRO
Affected
up to 3.2.10
What to do
Affects up to 3.2.10. Update Advanced Database Cleaner PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 5, 2026Form Vibes – Database Manager for Forms: SQL InjectionCVE-2025-13409 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to SQL Injection via the 'params' parameter in all versions up to, and including, 1.4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Form Vibes – Database Manager for Forms
Affected
up to 1.4.13
What to do
Affects up to 1.4.13. Update Form Vibes – Database Manager for Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025WordPress Contact Form 7 PDF, Google Sheet & Database: Unrestricted Upload of File with Dangerous TypeCVE-2025-64231 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sheet & Database: from n/a through <= 3.0.0.
Product
WordPress Contact Form 7 PDF, Google Sheet & Database
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update WordPress Contact Form 7 PDF, Google Sheet & Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 11, 2025Blaze Demo Importer: Unauthorized database resets and file deletionCVE-2025-13334 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a missing capability check on the "blaze_demo_importer_install_demo" function in all versions up to, and including, 1.0.13. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the database by truncating all tables (except options, usermeta, and users), delete all sidebar widgets, theme modifications, and content of the uploads folder.
Product
Blaze Demo Importer
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Blaze Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 31, 2025Advanced Database Cleaner: Cross-Site Request Forgery (CSRF)CVE-2025-64357 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR. Advanced Database Cleaner advanced-database-cleaner allows Cross Site Request Forgery.This issue affects Advanced Database Cleaner: from n/a through <= 3.1.6.
Product
Advanced Database Cleaner
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Advanced Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2025Advanced Database Cleaner: Cross-Site Request ForgeryCVE-2025-11497 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to missing or incorrect nonce validation on the aDBc_prepare_elements_to_clean() function. This makes it possible for unauthenticated attackers to alter the keep last setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2025-64357 is a duplicate of this issue.
Product
Advanced Database Cleaner
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Advanced Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2025Custom Searchable Data Entry System: Unauthenticated database wipingCVE-2020-36852 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazale_sds_delete_entries_table_row() function. This makes it possible for unauthenticated attackers to completely wipe database tables such as wp_users.
Product
Custom Searchable Data Entry System
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Custom Searchable Data Entry System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Sep 22, 2025Participants Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58008 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants Database: from n/a through <= 2.7.6.3.
Product
Participants Database
Affected
up to 2.7.6.3
What to do
Affects up to 2.7.6.3. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Database to Excel: Cross-Site Request Forgery (CSRF)CVE-2025-58844 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Subhash Kumar Database to Excel database-to-excel allows Stored XSS.This issue affects Database to Excel: from n/a through <= 1.0.
Product
Database to Excel
Affected
up to 1.0
What to do
Affects up to 1.0. Update Database to Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025WP-Database-Optimizer-Tools: Cross-Site Request Forgery (CSRF)CVE-2025-53219 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in pl4g4 WP-Database-Optimizer-Tools wp-database-optimizer-tools allows Cross Site Request Forgery.This issue affects WP-Database-Optimizer-Tools: from n/a through <= 0.2.
Product
WP-Database-Optimizer-Tools
Affected
up to 0.2
What to do
Affects up to 0.2. Update WP-Database-Optimizer-Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2025Database for Contact Form 7, WPforms, Elementor forms: PHP Object InjectionCVE-2025-7384 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2025WP Database Backup: OS Command InjectionCVE-2019-25224 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.
Product
WP Database Backup
Fixed in
5.2
What to do
Update WP Database Backup to 5.2 or newer.
Full record and what to do →NVD record blog.sucuri.net packetstormsecurity.com
Jul 22, 2025Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection): Arbitrary file deletionCVE-2025-7645 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete-file' field in all versions up to, and including, 3.2.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, when an administrator deletes the submission, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 4, 2025Contact Form 7 Database Addon: Stored Cross-Site ScriptingCVE-2025-6740 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form 7 Database Addon
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Contact Form 7 Database Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2025Backup Database: Does not sanitise and escape some of its settingsCVE-2024-8702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Backup Database
Affected
up to 4.9
What to do
Affects up to 4.9. Update Backup Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 2, 2025Database Toolset: Sensitive Information ExposureCVE-2025-4222 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This makes it possible for unauthenticated attackers to extract sensitive data from database backup files. An index file is present, so a brute force attack would need to be successful in order to compromise any data.
Product
Database Toolset
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2025Database Toolset: Arbitrary file deletionCVE-2025-3065 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Database Toolset
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 11, 2025Database Toolset: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32633 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in neoslab Database Toolset database-toolset allows Path Traversal.This issue affects Database Toolset: from n/a through <= 1.8.4.
Product
Database Toolset
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 20251-Click Backup & Restore Database: Missing AuthorizationCVE-2025-32246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Tim Nguyen 1-Click Backup & Restore Database 1-click-backup-restore-database-by-sunbytes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1-Click Backup & Restore Database: from n/a through <= 1.0.3.
Product
1-Click Backup & Restore Database
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update 1-Click Backup & Restore Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025PeproDev CF7 Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31573 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev CF7 Database pepro-cf7-database allows Stored XSS.This issue affects PeproDev CF7 Database: from n/a through <= 2.0.0.
Product
PeproDev CF7 Database
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update PeproDev CF7 Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Custom Database Applications by Caspio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspio Bridge Custom Database Applications by Caspio custom-database-applications-by-caspio allows DOM-Based XSS.This issue affects Custom Database Applications by Caspio: from n/a through <= 2.1.
Product
Custom Database Applications by Caspio
Affected
up to 2.1
What to do
Affects up to 2.1. Update Custom Database Applications by Caspio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025WP Database Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-31474 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Cross Site Request Forgery.This issue affects WP Database Optimizer: from n/a through <= 1.2.1.3.
Product
WP Database Optimizer
Affected
up to 1.2.1.3
What to do
Affects up to 1.2.1.3. Update WP Database Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025WP Database Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31473 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Stored XSS.This issue affects WP Database Optimizer: from n/a through <= 1.2.1.3.
Product
WP Database Optimizer
Affected
up to 1.2.1.3
What to do
Affects up to 1.2.1.3. Update WP Database Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025WP Database Audit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23633 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khanhtruong WP Database Audit database-audit allows Reflected XSS.This issue affects WP Database Audit: from n/a through <= 1.0.
Product
WP Database Audit
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Database Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 1, 2025Database Backup and check Tables Automated With Scheduler 2024: Arbitrary file deletionCVE-2024-13910 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'database_backup_ajax_delete' function in all versions up to, and including, 2.35. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 2.36.
Product
Database Backup and check Tables Automated With Scheduler 2024
Affected
up to 2.35
What to do
Affects up to 2.35. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2025Database Backup and check Tables Automated With Scheduler 2024: Sensitive Information ExposureCVE-2024-13911 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials.
Product
Database Backup and check Tables Automated With Scheduler 2024
Affected
up to 2.35
What to do
Affects up to 2.35. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025Database Sync: Missing AuthorizationCVE-2025-23486 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tamlyn Database Sync database-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database Sync: from n/a through <= 0.5.1.
Product
Database Sync
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update Database Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025Custom DataBase Tables: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ka2 Custom DataBase Tables custom-database-tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through <= 2.1.34.
Product
Custom DataBase Tables
Affected
up to 2.1.34
What to do
Affects up to 2.1.34. Update Custom DataBase Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025WP Database Backup – Unlimited Database & Files Backup by Backup for WP: Sensitive Information ExposureCVE-2024-12330 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database.
Product
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
Affected
up to 7.3
What to do
Affects up to 7.3. Update WP Database Backup – Unlimited Database & Files Backup by Backup for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Contact Form 7 Database – CFDB7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22351 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in penguinarts Contact Form 7 Database – CFDB7 advanced-cf7-database allows SQL Injection.This issue affects Contact Form 7 Database – CFDB7: from n/a through <= 1.0.0.
Product
Contact Form 7 Database – CFDB7
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Contact Form 7 Database – CFDB7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2024Database Backup and check Tables Automated With Scheduler 2024: Directory TraversalCVE-2024-12850 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the database_backup_ajax_download() function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Database Backup and check Tables Automated With Scheduler 2024
Affected
up to 2.32
What to do
Affects up to 2.32. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024Database for CF7: Missing AuthorizationCVE-2023-49167 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in code4life Database for CF7 database-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database for CF7: from n/a through <= 1.2.4.
Product
Database for CF7
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Database for CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 15, 2024External Database Based Actions: Authentication bypassCVE-2024-10311 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edba_admin_handle' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin settings and log in as any existing user on the site, such as an administrator.
Product
External Database Based Actions
Affected
up to 0.1
What to do
Affects up to 0.1. Update External Database Based Actions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2024Movie Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43300 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bert Movie Database movie-database allows Stored XSS.This issue affects Movie Database: from n/a through <= 1.0.11.
Product
Movie Database
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Movie Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Migration, Backup, Staging – WPvivid: Sensitive information disclosure of a WordPress site's databaseCVE-2020-36835 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing capability checks on the wp_ajax_wpvivid_add_remote AJAX action that allows low-level authenticated attackers to send back-ups to a remote location of their choice for review. This affects versions up to, and including 0.9.35.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.35
What to do
Affects up to 0.9.35. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org webarxsecurity.com
Sep 5, 2024Form Vibes – Database Manager for Forms: Unauthorized access of data and modification of dataCVE-2024-5309 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fv_export_csv, reset_settings, save_settings, save_columns_settings, get_analytics_data, get_event_logs_data, delete_submissions, and get_submissions functions in all versions up to, and including, 1.4.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple unauthorized actions. NOTE: This vulnerability is partially fixed in version 1.4.12.
Product
Form Vibes – Database Manager for Forms
Affected
up to 1.4.12
Fixed in
1.4.12
What to do
Update Form Vibes – Database Manager for Forms to 1.4.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2024Participants Database: Deserialization of Untrusted DataCVE-2024-43141 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.
Product
Participants Database
Affected
up to 2.5.9.2
What to do
Affects up to 2.5.9.2. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 10, 2024Table & Contact Form 7 Database – Tablesome: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.33.
Product
Table & Contact Form 7 Database – Tablesome
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update Table & Contact Form 7 Database – Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 2, 2024Quiz and Survey Master (QSM): Is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX actionCVE-2024-5606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
Product
Quiz and Survey Master (QSM)
Fixed in
9.0.2
What to do
Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2024kadence-blocks-pro: Does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the databaseCVE-2024-1330 · WordPress plugins & themes · reported by WPScanMedium 4.3
The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database.
Product
kadence-blocks-pro
Fixed in
2.3.8
What to do
Update kadence-blocks-pro to 2.3.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024Sparkle Demo Importer: Unauthorized database reset and demo data importCVE-2024-6120 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multiple functions in all versions up to and including 1.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all posts, pages, and uploaded files, as well as download and install a limited set of demo plugins.
Product
Sparkle Demo Importer
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Sparkle Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2024Database Cleaner: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35712 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.This issue affects Database Cleaner: from n/a through 1.0.5.
Product
Database Cleaner
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.