Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

163 results · page 2 of 4

Jan 14, 2026WMF Mobile Redirector: Stored Cross-Site ScriptingCVE-2026-0739 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WMF Mobile Redirector
Affected
up to 1.2
What to do
Affects up to 1.2. Update WMF Mobile Redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026AMP for WP – Accelerated Mobile Pages: Cross-Site Request ForgeryCVE-2025-14468 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to inverted nonce verification logic in the amp_theme_ajaxcomments AJAX handler, which rejects requests with VALID nonces and accepts requests with MISSING or INVALID nonces. This makes it possible for unauthenticated attackers to submit comments on behalf of logged-in users via a forged request granted they can trick a user into performing an action such as clicking on a link, and the plugin's template mode is enabled.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 31, 2025Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50053 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8.
Product
Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App
Affected
up to 0.8.8.8
What to do
Affects up to 0.8.8.8. Update Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Knowband Mobile App Builder: Does not have authorisationCVE-2025-13029 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.
Product
Knowband Mobile App Builder
Fixed in
3.0.0
What to do
Update Knowband Mobile App Builder to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 29, 2025Mobile builder: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-68860 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through <= 1.4.2.
Product
Mobile builder
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2025Popup Builder – Create highly converting, mobile friendly marketing popups.: Stored Cross-Site ScriptingCVE-2025-9856 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sg_popup' shortcode in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Popup Builder – Create highly converting, mobile friendly marketing popups.
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update Popup Builder – Create highly converting, mobile friendly marketing popups. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Hippoo Mobile App for WooCommerce: Arbitrary file writeCVE-2025-12655 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.
Product
Hippoo Mobile App for WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 10, 2025Hippoo Mobile App for WooCommerce: Path TraversalCVE-2025-13339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Hippoo Mobile App for WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 25, 2025Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile: Stored Cross-Site ScriptingCVE-2025-12032 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vithanhlam_zsocial_save_messager’, 'vithanhlam_zsocial_save_zalo', 'vithanhlam_zsocial_save_hotline', and 'vithanhlam_zsocial_save_contact' parameters in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 21, 2025Mstoreapp Mobile App: And Mstoreapp Mobile Multivendor through 9CVE-2025-11127 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.
Product
Mstoreapp Mobile App
Affected
up to 2.08
What to do
Affects up to 2.08. Update Mstoreapp Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 12, 2025Specific Content For Mobile – Customize the mobile version without redirections: SQL InjectionCVE-2025-11454 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is vulnerable to SQL Injection via the eos_scfm_duplicate_post_as_draft() function in all versions up to, and including, 0.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with COntributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Specific Content For Mobile – Customize the mobile version without redirections
Affected
up to 0.5.5
What to do
Affects up to 0.5.5. Update Specific Content For Mobile – Customize the mobile version without redirections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 6, 2025WPMobile.App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62074 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.71.
Product
WPMobile.App
Affected
up to 11.71
What to do
Affects up to 11.71. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2025Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App: Unauthorized access of dataCVE-2025-11833 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
Product
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 30, 2025AppPresser – Mobile App Framework: Unauthorized access of dataCVE-2025-11881 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'myappp_verify' function in all versions up to, and including, 4.5.0. This makes it possible for unauthenticated attackers to extract sensitive data including plugin and theme names and version numbers, which can be used to facilitate targeted attacks against outdated or vulnerable components.
Product
AppPresser – Mobile App Framework
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025Toast Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Toast Mobile Menu toast-responsive-menu allows Stored XSS.This issue affects Toast Mobile Menu: from n/a through <= 1.0.8.
Product
Toast Mobile Menu
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Toast Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 3, 2025Mobile Site Redirect: Cross-Site Request ForgeryCVE-2025-9884 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Mobile Site Redirect
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Mobile Site Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 3, 2025Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: SQL InjectionCVE-2025-9200 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments() function in all versions up to, and including, 0.8.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App
Affected
up to 0.8.8.8
What to do
Affects up to 0.8.8.8. Update Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 3, 2025Mobile Contact Line: Missing AuthorizationCVE-2025-58622 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile Contact Line: from n/a through <= 2.4.0.
Product
Mobile Contact Line
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Mobile Contact Line to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin forCVE-2025-9219 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions.
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2025Responsive Mobile-Friendly Tooltip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48316 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip responsive-mobile-friendly-tooltip allows Stored XSS.This issue affects Responsive Mobile-Friendly Tooltip: from n/a through <= 1.6.6.
Product
Responsive Mobile-Friendly Tooltip
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Responsive Mobile-Friendly Tooltip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 19, 2025WP Mobile Detector: Arbitrary file uploadsCVE-2016-15043 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
WP Mobile Detector
Affected
up to 3.5
What to do
Affects up to 3.5. Update WP Mobile Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record aadityapurani.com blog.sucuri.net
Jun 27, 2025Mobile DJ Manager: Missing AuthorizationCVE-2025-52824 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile DJ Manager: from n/a through <= 1.7.8.3.
Product
Mobile DJ Manager
Affected
up to 1.7.8.3
What to do
Affects up to 1.7.8.3. Update Mobile DJ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025isMobile: Stored Cross-Site ScriptingCVE-2025-6488 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The isMobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
isMobile
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update isMobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 6, 2025ShiftNav – Responsive Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49243 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-responsive-mobile-menu allows Stored XSS.This issue affects ShiftNav – Responsive Mobile Menu: from n/a through <= 1.8.
Product
ShiftNav – Responsive Mobile Menu
Affected
up to 1.8
What to do
Affects up to 1.8. Update ShiftNav – Responsive Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 21, 2025DIGITS: WordPress Mobile Number Signup and Login: Does not rate limit OTP validation attemptsCVE-2025-4094 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
Product
DIGITS: WordPress Mobile Number Signup and Login
Fixed in
8.4.6.1
What to do
Update DIGITS: WordPress Mobile Number Signup and Login to 8.4.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 16, 2025Push notification for Mobile and Web app: Missing AuthorizationCVE-2025-48127 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through <= 2.0.3.
Product
Push notification for Mobile and Web app
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Push notification for Mobile and Web app to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Mobile Contact Bar: Does not sanitise and escape some of its settingsCVE-2024-12739 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Mobile Contact Bar
Fixed in
3.0.5
What to do
Update Mobile Contact Bar to 3.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2025Mobile App for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocommerce allows Stored XSS.This issue affects Mobile App for WooCommerce: from n/a through <= 0.4.61.
Product
Mobile App for WooCommerce
Affected
up to 0.4.61
What to do
Affects up to 0.4.61. Update Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Mobile Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32625 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Mobile Pages mobile-pages allows Reflected XSS.This issue affects Mobile Pages: from n/a through <= 1.0.2.
Product
Mobile Pages
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2025-2269 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.34
What to do
Affects up to 1.8.34. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 11, 2025Mobile Smart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31021 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dolby_uk Mobile Smart mobile-smart allows Reflected XSS.This issue affects Mobile Smart: from n/a through <= v1.3.16.
Product
Mobile Smart
Affected
up to 1.3.16
What to do
Affects up to 1.3.16. Update Mobile Smart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP Mobile Bottom Menu: Missing AuthorizationCVE-2025-31525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah WP Mobile Bottom Menu mobile-bottom-menu-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mobile Bottom Menu: from n/a through <= 1.4.0.
Product
WP Mobile Bottom Menu
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update WP Mobile Bottom Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Mobile App Canvas: Missing AuthorizationCVE-2025-31816 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in pietro Mobile App Canvas mobile-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile App Canvas: from n/a through <= 3.8.2.
Product
Mobile App Canvas
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update Mobile App Canvas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Mobile DJ Manager: Deserialization of Untrusted DataCVE-2025-31074 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Object Injection.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.2.
Product
Mobile DJ Manager
Affected
up to 1.7.5.2
What to do
Affects up to 1.7.5.2. Update Mobile DJ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Specific Content For Mobile: Missing AuthorizationCVE-2025-30874 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Mortellaro Specific Content For Mobile specific-content-for-mobile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Specific Content For Mobile: from n/a through <= 0.5.3.
Product
Specific Content For Mobile
Affected
up to 0.5.3
What to do
Affects up to 0.5.3. Update Specific Content For Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Mobile Navigation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30574 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jenst Mobile Navigation mobile-navigation allows Stored XSS.This issue affects Mobile Navigation: from n/a through <= 1.5.
Product
Mobile Navigation
Affected
up to 1.5
What to do
Affects up to 1.5. Update Mobile Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2025AppPresser – Mobile App Framework: Stored Cross-Site ScriptingCVE-2025-1561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when logging is enabled that will execute whenever a user accesses an injected page.
Product
AppPresser – Mobile App Framework
Affected
up to 4.4.10
What to do
Affects up to 4.4.10. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025Mobile: Cross-Site Request Forgery (CSRF)CVE-2025-28881 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in mg12 Mobile Themes wp-mobile-themes allows Cross Site Request Forgery.This issue affects Mobile Themes: from n/a through <= 1.1.1.
Product
Mobile
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Mobile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muneeb Mobile rocket-wp-mobile allows Reflected XSS.This issue affects Mobile: from n/a through <= 1.3.3.
Product
Mobile
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2025WPMobile.App: Open RedirectCVE-2024-13888 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
WPMobile.App
Affected
up to 11.56
What to do
Affects up to 11.56. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 24, 2025Mobile DJ Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22714 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Reflected XSS.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.6.
Product
Mobile DJ Manager
Affected
up to 1.7.5.6
What to do
Affects up to 1.7.5.6. Update Mobile DJ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025AddFunc Mobile Detect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22550 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Rhoney AddFunc Mobile Detect addfunc-mobile-detect allows Stored XSS.This issue affects AddFunc Mobile Detect: from n/a through <= 3.1.
Product
AddFunc Mobile Detect
Affected
up to 3.1
What to do
Affects up to 3.1. Update AddFunc Mobile Detect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WP Mobile Menu: Cross-Site Request Forgery (CSRF)CVE-2024-37274 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rui Guerreiro WP Mobile Menu mobile-menu allows Cross Site Request Forgery.This issue affects WP Mobile Menu: from n/a through <= 2.8.4.3.
Product
WP Mobile Menu
Affected
up to 2.8.4.3
What to do
Affects up to 2.8.4.3. Update WP Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024VW Automobile Lite: Missing AuthorizationCVE-2024-56234 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in vowelweb VW Automobile Lite vw-automobile-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Automobile Lite: from n/a through <= 2.1.
Product
VW Automobile Lite
Affected
up to 2.1
What to do
Affects up to 2.1. Update VW Automobile Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 17, 2024AMP for WP – Accelerated Mobile Pages: Reflected Cross-Site ScriptingCVE-2024-11254 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter in all versions up to, and including, 1.1.1 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024ListApp Mobile Manager: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54295 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through <= 1.7.7.
Product
ListApp Mobile Manager
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update ListApp Mobile Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024The WPMobile.App — Android and iOS Mobile Application: Arbitrary shortcode executionCVE-2024-12420 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The WPMobile.App — Android and iOS Mobile Application
Affected
up to 11.52
What to do
Affects up to 11.52. Update The WPMobile.App — Android and iOS Mobile Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 28, 2024Login with Vipps and MobilePay: Stored Cross-Site ScriptingCVE-2024-11786 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Login with Vipps and MobilePay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'continue-with-vipps' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Login with Vipps and MobilePay
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Login with Vipps and MobilePay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 26, 2024AppPresser – Mobile App Framework: Privilege escalationCVE-2024-11024 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possible for unauthenticated attackers, with knowledge of a user's email address, to reset the user's password and gain access to their account.
Product
AppPresser – Mobile App Framework
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 19, 2024Mobile Kiosk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51829 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in figoliquinn Mobile Kiosk mobile-kiosk allows Stored XSS.This issue affects Mobile Kiosk: from n/a through <= 1.3.0.
Product
Mobile Kiosk
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Mobile Kiosk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.