Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
73 results · page 2 of 2
Jan 29, 2025Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later: Stored Cross-Site ScriptingCVE-2024-13696 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later
- Affected
- up to 1.2.25
- What to do
- Affects up to 1.2.25. Update Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 25, 2025Flexmls® IDX: Stored Cross-Site ScriptingCVE-2024-10552 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘api_key’ and 'api_secret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 3.14.25.
- Product
- Flexmls® IDX
- Affected
- up to 3.14.26
- What to do
- Affects up to 3.14.26. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2025Flexible Blogtitle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23846 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thaikolja Flexible Blogtitle flexible-blogtitle allows Reflected XSS.This issue affects Flexible Blogtitle: from n/a through <= 0.1.
- Product
- Flexible Blogtitle
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Flexible Blogtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Flexible PDF Coupons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22825 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through < 1.10.3.
- Product
- Flexible PDF Coupons
- What to do
- Update Flexible PDF Coupons to the newest version.
Dec 9, 2024Flexible Woocommerce Checkout Field Editor: Missing AuthorizationCVE-2023-49817 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in heoLixfy Flexible Woocommerce Checkout Field Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Woocommerce Checkout Field Editor: from n/a through 2.0.1.
- Product
- Flexible Woocommerce Checkout Field Editor
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Flexible Woocommerce Checkout Field Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Tigris Flexplatform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51819 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tigrisflexplatform Tigris Flexplatform tigris-flexplatform allows Stored XSS.This issue affects Tigris Flexplatform: from n/a through <= 1.0.2.
- Product
- Tigris Flexplatform
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Tigris Flexplatform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Flexmls® IDX: Reflected Cross-Site ScriptingCVE-2024-8719 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all versions up to, and including, 3.14.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Flexmls® IDX
- Affected
- up to 3.14.22
- What to do
- Affects up to 3.14.22. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 5, 2024Payflex Payment Gateway: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47646 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in tomlister Payflex Payment Gateway payflex-payment-gateway.This issue affects Payflex Payment Gateway: from n/a through <= 2.6.1.
- Product
- Payflex Payment Gateway
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Payflex Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate: Reflected Cross-Site ScriptingCVE-2024-9237 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2024Payflex Payment Gateway: Unauthorized modification of dataCVE-2024-0619 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the payment_callback() function in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to update the status of orders, which can potentially lead to revenue loss.
- Product
- Payflex Payment Gateway
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Payflex Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2024Flexible Checkout Fields for WooCommerce: Missing AuthorizationCVE-2024-31267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2.
- Product
- Flexible Checkout Fields for WooCommerce
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update Flexible Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Flexible Shipping: Missing AuthorizationCVE-2024-32828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Octolize Flexible Shipping.This issue affects Flexible Shipping: from n/a through 4.24.15.
- Product
- Flexible Shipping
- Affected
- up to 4.24.15
- What to do
- Affects up to 4.24.15. Update Flexible Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce sCVE-2023-34015 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin <= 1.6.4.4 versions.
- Fixed in
- 1.6.4.6
- What to do
- Update the plugin to 1.6.4.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 6, 2023Flexible Checkout Fields for WooCommerce: Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site ScriptingCVE-2020-36731 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.
- Product
- Flexible Checkout Fields for WooCommerce
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Flexible Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in WebMat Flexible Elementor Panel plugin <= 2.3.8 versions.CVE-2022-45076 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WebMat Flexible Elementor Panel plugin <= 2.3.8 versions.
- Fixed in
- 2.3.9
- What to do
- Update the plugin to 2.3.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 13, 2023Meks Flexible Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4562 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meks Flexible Shortcodes WordPress plugin before 1.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Meks Flexible Shortcodes
- Fixed in
- 1.3.5
- What to do
- Update Meks Flexible Shortcodes to 1.3.5 or newer.
Feb 6, 2023Flexible Captcha: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0147 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Flexible Captcha
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Flexible Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Flexi Quote Rotator: Does not sanitise and escape its settingsCVE-2022-2328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flexi Quote Rotator
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Flexi Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Flexi: Does not sanitise and escape various parameters before outputting them back in some pages suchCVE-2022-0449 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Flexi
- Fixed in
- 4.20
- What to do
- Update Flexi to 4.20 or newer.
Dec 13, 2021Flex Local Fonts: Does not escape the Class Name fieldCVE-2021-24782 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flex Local Fonts
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Flex Local Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2019The reflex-gallery plugin before 1.4.3 for WordPress has XSS.CVE-2013-7482 · WordPress plugins & themes · reported by MITREMedium 6.1
The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
- Product
- reflex-gallery
- Fixed in
- 1.4.3
- What to do
- Update reflex-gallery to 1.4.3 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
May 28, 2015Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to CVE-2015-4133 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
- Product
- Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery
- Fixed in
- 3.1.4
- What to do
- Update Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery to 3.1.4 or newer.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Aug 23, 2012Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject aCVE-2011-5106 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
- Product
- Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type
- Fixed in
- 0.1.7
- What to do
- Update Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type to 0.1.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.