Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

276 results · page 2 of 6

Dec 30, 2025DesignThemes Portfolio Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68977 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.
Product
DesignThemes Portfolio Addon
Affected
up to 1.5
What to do
Affects up to 1.5. Update DesignThemes Portfolio Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Follow My Blog Post: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64258 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Retrieve Embedded Sensitive Data.This issue affects Follow My Blog Post: from n/a through <= 2.3.9.
Product
Follow My Blog Post
Affected
up to 2.3.9
What to do
Affects up to 2.3.9. Update Follow My Blog Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Salient Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68078 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows Stored XSS.This issue affects Salient Portfolio: from n/a through <= 1.8.2.
Product
Salient Portfolio
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Salient Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025CatFolders: Missing AuthorizationCVE-2025-66120 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CatFolders CatFolders catfolders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CatFolders: from n/a through <= 2.5.3.
Product
CatFolders
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update CatFolders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 15, 2025FileBird – WordPress Media Library Folders & File Manager: Missing authorizationCVE-2025-12900 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author level access and above, to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025MediaCommander – Bring Folders to Media, Posts, and Pages: Unauthorized data deletionCVE-2025-14508 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files` capability check (Author level) for a destructive operation that can delete all folders. This makes it possible for authenticated attackers, with Author-level access and above, to delete all folder organization data created by Administrators and other users.
Product
MediaCommander – Bring Folders to Media, Posts, and Pages
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update MediaCommander – Bring Folders to Media, Posts, and Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2025Themify Portfolio Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Portfolio Post themify-portfolio-post allows Stored XSS.This issue affects Themify Portfolio Post: from n/a through <= 1.3.0.
Product
Themify Portfolio Post
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Themify Portfolio Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Portfolio and Projects: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.
Product
Portfolio and Projects
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Simple Folio: Cross-Site Request Forgery (CSRF)CVE-2025-64256 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Folio simple-folio allows Cross Site Request Forgery.This issue affects Simple Folio: from n/a through <= 1.1.0.
Product
Simple Folio
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Simple Folio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025DoFollow Case by Case: Cross-Site Request Forgery (CSRF)CVE-2025-62102 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
Product
DoFollow Case by Case
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 202510Web Booster – Website speed optimization, Cache & Page Speed optimizer: Arbitrary folder deletionCVE-2025-13377 · WordPress plugins & themes · reported by WordfenceCritical 9.6
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
Product
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
Affected
up to 2.32.7
What to do
Affects up to 2.32.7. Update 10Web Booster – Website speed optimization, Cache & Page Speed optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2025Social Feed Gallery Portfolio: Stored Cross-Site ScriptingCVE-2025-13896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Feed Gallery Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [igp-wp] shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Feed Gallery Portfolio
Affected
up to 1.3
What to do
Affects up to 1.3. Update Social Feed Gallery Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2025Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unauthorized modification of dataCVE-2025-12971 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders.
Product
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2025Simple Folio: Stored Cross-Site ScriptingCVE-2025-12151 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'portfolio_name' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Folio
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Simple Folio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2025Enfold: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66053 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects Enfold: from n/a through <= 7.1.2.
Product
Enfold
Affected
up to 7.1.2
What to do
Affects up to 7.1.2. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2025Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers: Stored Cross-Site ScriptingCVE-2025-12484 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple social media username parameters in all versions up to, and including, 1.12.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
Affected
up to 1.12.19
What to do
Affects up to 1.12.19. Update Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2025Penci Bookmark & Follow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49909 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Bookmark & Follow penci-bookmark-follow allows Reflected XSS.This issue affects Penci Bookmark & Follow: from n/a through < 2.4.
Product
Penci Bookmark & Follow
What to do
Update Penci Bookmark & Follow to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Hubbub Lite – Fast, free social sharing and follow buttons: Reflected Cross-Site ScriptingCVE-2025-12471 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dpsp_list_attention_search' parameter in all versions up to, and including, 1.36.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Hubbub Lite – Fast, free social sharing and follow buttons
Affected
up to 1.36.0
What to do
Affects up to 1.36.0. Update Hubbub Lite – Fast, free social sharing and follow buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2025Premium Portfolio Features for Phlox: Local File InclusionCVE-2025-12497 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
Premium Portfolio Features for Phlox
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update Premium Portfolio Features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 4, 2025Bootstrap Multi-language Responsive Portfolio: Stored Cross-Site ScriptingCVE-2025-11753 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Bootstrap Multi-language Responsive Portfolio
Affected
up to 1.0
What to do
Affects up to 1.0. Update Bootstrap Multi-language Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Nov 1, 2025Folderly: Unauthorized modification of dataCVE-2025-12038 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Folderly plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the /wp-json/folderly/v1/config/clear-all-data REST API endpoint in all versions up to, and including, 0.3. This makes it possible for authenticated attackers, with Author-level access and above, to clear all data like terms and categories.
Product
Folderly
Affected
up to 0.3
What to do
Affects up to 0.3. Update Folderly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Hello Followers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appscreo Hello Followers hellofollowers allows Reflected XSS.This issue affects Hello Followers: from n/a through <= 2.5.
Product
Hello Followers
Affected
up to 2.5
What to do
Affects up to 2.5. Update Hello Followers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2025FileBird – WordPress Media Library Folders & File Manager: Unauthorized modification of dataCVE-2025-11510 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /filebird/v1/fb-wipe-clear-all-data function in all versions up to, and including, 6.4.9. This makes it possible for authenticated attackers, with author-level access and above, to reset all of the plugin's configuration data.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.4.9
What to do
Affects up to 6.4.9. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2025Penci Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59586 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Portfolio penci-portfolio allows DOM-Based XSS.This issue affects Penci Portfolio: from n/a through <= 3.5.
Product
Penci Portfolio
Affected
up to 3.5
What to do
Affects up to 3.5. Update Penci Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58245 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Portfolio portfolio allows DOM-Based XSS.This issue affects Portfolio : from n/a through <= 2.58.
Product
Portfolio
Affected
up to 2.58
What to do
Affects up to 2.58. Update Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Advance Portfolio Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57982 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean Advance Portfolio Grid advance-portfolio-grid allows Stored XSS.This issue affects Advance Portfolio Grid: from n/a through <= 1.07.6.
Product
Advance Portfolio Grid
Affected
up to 1.07.6
What to do
Affects up to 1.07.6. Update Advance Portfolio Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025PowerFolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Diego Pereira PowerFolio portfolio-elementor allows Stored XSS.This issue affects PowerFolio: from n/a through <= 3.2.1.
Product
PowerFolio
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update PowerFolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57913 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Product
Behance Portfolio Manager
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2025CatFolders – Tame Your WordPress Media Library by Category: Time-based SQL InjectionCVE-2025-9776 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
CatFolders – Tame Your WordPress Media Library by Category
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update CatFolders – Tame Your WordPress Media Library by Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Responsive Filterable Portfolio: Arbitrary file uploadsCVE-2025-10049 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelection_image field in all versions up to, and including, 1.0.24. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Responsive Filterable Portfolio
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update Responsive Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 20, 2025Prevent files / folders access: Path Traversal: '.../...//'CVE-2025-53561 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through <= 2.6.0.
Product
Prevent files / folders access
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Prevent files / folders access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Ultra Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49420 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Reflected XSS.This issue affects Ultra Portfolio: from n/a through <= 6.7.
Product
Ultra Portfolio
Affected
up to 6.7
What to do
Affects up to 6.7. Update Ultra Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Cube Portfolio: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52823 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injection.This issue affects Cube Portfolio: from n/a through <= 1.16.8.
Product
Cube Portfolio
Affected
up to 1.16.8
What to do
Affects up to 1.16.8. Update Cube Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 5, 2025FileBird – WordPress Media Library Folders & File Manager: SQL InjectionCVE-2025-6986 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 6.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 26, 2025Kallyas: Arbitrary folder deletionCVE-2025-6989 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all versions up to, and including, 4.21.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders on the server.
Product
Kallyas
Affected
up to 4.21.0
What to do
Affects up to 4.21.0. Update Kallyas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 22, 2025The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerabCVE-2025-7644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 16, 2025Media Folder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52786 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kingdom Creation Media Folder media-folder allows Reflected XSS.This issue affects Media Folder: from n/a through <= 1.0.0.
Product
Media Folder
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Media Folder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025SMu Manual DoFollow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49031 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefan M. SMu Manual DoFollow manuall-dofollow allows Reflected XSS.This issue affects SMu Manual DoFollow: from n/a through <= 1.8.1.
Product
SMu Manual DoFollow
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update SMu Manual DoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Brandfolder: Stored Cross-Site ScriptingCVE-2025-5843 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Brandfolder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 5.0.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Brandfolder
Affected
up to 5.0.19
What to do
Affects up to 5.0.19. Update Brandfolder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2025Portfolio for Elementor & Image Gallery | PowerFolio: Stored Cross-Site ScriptingCVE-2025-7046 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Product
Portfolio for Elementor & Image Gallery | PowerFolio
Affected
up to 3.2.0
Fixed in
3.2.0
What to do
Update Portfolio for Elementor & Image Gallery | PowerFolio to 3.2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 25, 2025Drive Folder Embedder: Stored Cross-Site ScriptingCVE-2025-6546 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Drive Folder Embedder
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Drive Folder Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 6, 2025Behance Portfolio Manager: Missing AuthorizationCVE-2025-29010 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Product
Behance Portfolio Manager
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Mediabay - WordPress Media Library Folders: Cross-Site Request Forgery (CSRF)CVE-2025-28948 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.
Product
Mediabay - WordPress Media Library Folders
Affected
up to 1.4
What to do
Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Ultimate Noindex Nofollow Tool II: Does not sanitise and escape some of its settingsCVE-2024-1663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Ultimate Noindex Nofollow Tool II
Fixed in
1.3.6
What to do
Update Ultimate Noindex Nofollow Tool II to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Ultimate Noindex Nofollow Tool: Does not have CSRF check in placeCVE-2023-7196 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Ultimate Noindex Nofollow Tool
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Ultimate Noindex Nofollow Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Better Follow Button for Jetpack: Does not sanitise and escape some of its settingsCVE-2023-7168 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Better Follow Button for Jetpack
Affected
up to 8.0
What to do
Affects up to 8.0. Update Better Follow Button for Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 12, 2025BNS Twitter Follow Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Caissie BNS Twitter Follow Button bns-twitter-follow-button allows DOM-Based XSS.This issue affects BNS Twitter Follow Button: from n/a through <= 0.3.8.
Product
BNS Twitter Follow Button
Affected
up to 0.3.8
What to do
Affects up to 0.3.8. Update BNS Twitter Follow Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025DoFollow Case by Case: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47625 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Stored XSS.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
Product
DoFollow Case by Case
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025DoFollow Case by Case: Cross-Site Request Forgery (CSRF)CVE-2025-47624 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
Product
DoFollow Case by Case
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025WZ Followed Posts – Display what visitors are reading: Stored Cross-Site ScriptingCVE-2025-4171 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WZ Followed Posts – Display what visitors are reading
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update WZ Followed Posts – Display what visitors are reading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.