Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

256 results · page 2 of 6

May 15, 2026WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batchedCVE-2021-47959 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields. Attackers can send POST requests to the GraphQL endpoint with amplified field duplication payloads to trigger server out-of-memory conditions and MySQL connection errors.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com vulncheck.com
May 10, 2026WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requeCVE-2021-47933 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 4, 2026Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParseCVE-2026-25863 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can supply an arbitrarily large integer value through the REST API endpoint to cause unbounded loop execution with multiple preg_replace() operations, exhausting server memory and crashing the PHP process.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org vulncheck.com
May 2, 2026Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets: Remote Code ExecutionCVE-2026-2052 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0.
Product
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2026Conditional Menus: Cross-Site Request ForgeryCVE-2026-1032 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Conditional Menus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.6. This is due to missing nonce validation on the 'save_options' function. This makes it possible for unauthenticated attackers to modify conditional menu assignments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Conditional Menus
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Conditional Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Punnel – Landing Page Builder: Missing AuthorizationCVE-2026-3645 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1. The save_config() function, which handles the 'punnel_save_config' AJAX action, lacks any capability check (current_user_can()) and nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's entire configuration including the API key via a POST request to admin-ajax.php. Once the API key is known (because the attacker set it), the attacker can use the plugin's public API endpoint (sniff_requests() at /?punnel_api=1) — which only validates requests by comparing a POST token against the stored api_key — to create, update, or delete arbitrary posts, pages, and products on the site.
Product
Punnel – Landing Page Builder
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Punnel – Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Content Syndication Toolkit: Server-Side Request ForgeryCVE-2026-3478 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET['url'] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.
Product
Content Syndication Toolkit
Affected
up to 1.3
What to do
Affects up to 1.3. Update Content Syndication Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026Lawyer Landing Page: Missing AuthorizationCVE-2026-32487 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Landing Page: from n/a through <= 1.2.7.
Product
Lawyer Landing Page
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Lawyer Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026TeraWallet – For WooCommerce: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-32398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Subrata Mal TeraWallet – For WooCommerce woo-wallet allows Leveraging Race Conditions.This issue affects TeraWallet – For WooCommerce: from n/a through <= 1.5.15.
Product
TeraWallet – For WooCommerce
Affected
up to 1.5.15
What to do
Affects up to 1.5.15. Update TeraWallet – For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026App Landing Page: Missing AuthorizationCVE-2026-32381 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through <= 1.2.2.
Product
App Landing Page
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update App Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Book Landing Page: Missing AuthorizationCVE-2026-32378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Book Landing Page book-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Landing Page: from n/a through <= 1.2.7.
Product
Book Landing Page
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Book Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Construction Landing Page: Missing AuthorizationCVE-2026-32338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Construction Landing Page construction-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Landing Page: from n/a through <= 1.4.1.
Product
Construction Landing Page
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Construction Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 7, 2026Font Pairing Preview For Landing Pages: Cross-Site Request ForgeryCVE-2026-1086 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Font Pairing Preview For Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify the plugin's font pairing settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Font Pairing Preview For Landing Pages
Affected
up to 1.3
What to do
Affects up to 1.3. Update Font Pairing Preview For Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026AC Services | HVAC, Air Conditioning & Heating Company: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27326 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme window-ac-services allows PHP Local File Inclusion.This issue affects AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme: from n/a through <= 1.2.5.
Product
AC Services | HVAC, Air Conditioning & Heating Company
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update AC Services | HVAC, Air Conditioning & Heating Company to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Lendiz: Unrestricted Upload of File with Dangerous TypeCVE-2025-68553 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Lendiz lendiz allows Upload a Web Shell to a Web Server.This issue affects Lendiz: from n/a through < 2.0.1.
Product
Lendiz
What to do
Update Lendiz to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 22, 2026Conditional CAPTCHA: Does not validate a parameter before redirecting the user to its valueCVE-2026-1369 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
Product
Conditional CAPTCHA
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Conditional CAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 18, 2026Display During Conditional Shortcode: Stored Cross-Site ScriptingCVE-2025-6460 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Display During Conditional Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Display During Conditional Shortcode
Affected
up to 1.2
What to do
Affects up to 1.2. Update Display During Conditional Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 4, 2026Xendit Payment: Unauthorized order status manipulationCVE-2025-14461 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the plugin exposing a publicly accessible WooCommerce API callback endpoint (`wc_xendit_callback`) that processes payment callbacks without any authentication or cryptographic verification that the requests originate from Xendit's payment gateway. This makes it possible for unauthenticated attackers to mark any WooCommerce order as paid by sending a crafted POST request to the callback URL with a JSON body containing an `external_id` matching the order ID pattern and a `status` of 'PAID' or 'SETTLED', granted they can enumerate order IDs (which are sequential integers). This leads to orders being fraudulently marked as completed without any actual payment, resulting in financial loss and inventory depletion.
Product
Xendit Payment
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Xendit Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026Landing Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24620 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder page-builder-add allows Stored XSS.This issue affects Landing Page Builder: from n/a through <= 1.5.3.4.
Product
Landing Page Builder
Affected
up to 1.5.3.4
What to do
Affects up to 1.5.3.4. Update Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2026Kalium 3 | Creative WordPress & WooCommerce: Unauthorized email sendingCVE-2025-12895 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf.
Product
Kalium 3 | Creative WordPress & WooCommerce
Affected
up to 3.29
What to do
Affects up to 3.29. Update Kalium 3 | Creative WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record documentation.laborator.co themeforest.net
Jan 9, 2026IndieWeb: Stored Cross-Site ScriptingCVE-2025-14893 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
IndieWeb
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update IndieWeb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2026Bulk Landing Page Creator for WordPress LPagery: Missing AuthorizationCVE-2026-22490 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Landing Page Creator for WordPress LPagery: from n/a through <= 2.4.9.
Product
Bulk Landing Page Creator for WordPress LPagery
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Bulk Landing Page Creator for WordPress LPagery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026Moosend Landing Pages: Unauthorized modification of dataCVE-2025-13496 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Moosend Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the moosend_landings_auth_get function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the 'moosend_landing_api_key' option value.
Product
Moosend Landing Pages
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Moosend Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025ANAC XML Bandi di Gara: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64260 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Milesi ANAC XML Bandi di Gara avcp allows Reflected XSS.This issue affects ANAC XML Bandi di Gara: from n/a through <= 7.7.
Product
ANAC XML Bandi di Gara
Affected
up to 7.7
What to do
Affects up to 7.7. Update ANAC XML Bandi di Gara to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Sendinblue for WooCommerce: Missing AuthorizationCVE-2025-66128 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendinblue for WooCommerce: from n/a through <= 4.0.49.
Product
Sendinblue for WooCommerce
Affected
up to 4.0.49
What to do
Affects up to 4.0.49. Update Sendinblue for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 11, 2025App Landing Template Blocks for WPBakery (Visual Composer) Page Builder: Stored Cross-Site ScriptingCVE-2025-14119 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_video_play' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
App Landing Template Blocks for WPBakery (Visual Composer) Page Builder
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update App Landing Template Blocks for WPBakery (Visual Composer) Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025WP Landing Page: Cross-Site Request ForgeryCVE-2025-13629 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the 'wplp_api_update_text' function. This makes it possible for unauthenticated attackers to update arbitrary post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Landing Page
Affected
up to 0.9.3
What to do
Affects up to 0.9.3. Update WP Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Search, Filters & Merchandising for WooCommerce: Unauthorized modification of dataCVE-2025-12091 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.67. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin.
Product
Search, Filters & Merchandising for WooCommerce
Affected
up to 3.0.67
What to do
Affects up to 3.0.67. Update Search, Filters & Merchandising for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Webcake – Landing Page Builder: Unauthorized modification of dataCVE-2025-12165 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Webcake – Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'webcake_save_config' AJAX endpoint in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings.
Product
Webcake – Landing Page Builder
Affected
up to 1.1
What to do
Affects up to 1.1. Update Webcake – Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 25, 2025Conditional Maintenance Mode for: Cross-Site Request ForgeryCVE-2025-12586 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to enable or disable the site's maintenance mode via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
Conditional Maintenance Mode for
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Conditional Maintenance Mode for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2025Booking Plugin for WordPress Appointments – Time Slot: Unauthorized email sendingCVE-2025-12842 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1.4.7 due to missing validation on the tslot_appt_email AJAX action. This makes it possible for unauthenticated attackers to send appointment notification emails to arbitrary recipients with attacker-controlled text content in certain email fields, potentially enabling the site to be abused for phishing campaigns or spam distribution.
Product
Booking Plugin for WordPress Appointments – Time Slot
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Booking Plugin for WordPress Appointments – Time Slot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 18, 2025Local Syndication: Server-Side Request ForgeryCVE-2025-12962 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5a via the `url` parameter in the `[syndicate_local]` shortcode. This is due to the use of `wp_remote_get()` instead of `wp_safe_remote_get()` which lacks protections against requests to internal/private IP addresses and localhost. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal networks, and access resources that should not be accessible from external networks.
Product
Local Syndication
Affected
up to 1.5a
What to do
Affects up to 1.5a. Update Local Syndication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2025RESTful Content Syndication: Arbitrary file uploadsCVE-2025-12171 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function in versions 1.1.0 to 1.5.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This requires the attacker have access to a defined third-party server as specified in the settings, so it is unlikely that this will be exploitable by contributor-level users, and more likely to be exploited by administrators who also have access to the plugin's settings.
Product
RESTful Content Syndication
Affected
1.1.0 to 1.5.0
What to do
Affects 1.1.0 to 1.5.0. Update RESTful Content Syndication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 31, 2025Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Unauthorized modification of dataCVE-2025-11816 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disconnect_account_request() function in all versions up to, and including, 3.5.1. This makes it possible for unauthenticated attackers to disconnect the site from its API plan.
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2025IndieAuth: Cross-Site Request ForgeryCVE-2025-12028 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete).
Product
IndieAuth
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update IndieAuth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025WhyDonate – FREE Donate button – Crowdfunding – Fundraising: Unauthorized loss of dataCVE-2025-10186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
Product
WhyDonate – FREE Donate button – Crowdfunding – Fundraising
Affected
up to 4.0.15
What to do
Affects up to 4.0.15. Update WhyDonate – FREE Donate button – Crowdfunding – Fundraising to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 26, 2025Conditional Cart Messages for WooCommerce – YourPlugins.com: Cross-Site Request Forgery (CSRF)CVE-2025-60171 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in yourplugins Conditional Cart Messages for WooCommerce – YourPlugins.com yourplugins-wc-conditional-cart-notices allows Stored XSS.This issue affects Conditional Cart Messages for WooCommerce – YourPlugins.com: from n/a through <= 1.2.10.
Product
Conditional Cart Messages for WooCommerce – YourPlugins.com
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Conditional Cart Messages for WooCommerce – YourPlugins.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025MasterStudy LMS: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2025-59577 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Leveraging Race Conditions.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Product
MasterStudy LMS
Affected
up to 3.6.20
What to do
Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 18, 2025Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Unauthorized access of functionalityCVE-2025-8565 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplp_gdpr_install_plugin_ajax_handler() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to install arbitrary repository plugins.
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 5, 2025Elementor Element Condition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dudaster Elementor Element Condition ele-conditions allows Stored XSS.This issue affects Elementor Element Condition: from n/a through <= 1.0.5.
Product
Elementor Element Condition
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Elementor Element Condition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025ReachShip WooCommerce Multi-Carrier & Conditional Shipping: Unrestricted Upload of File with Dangerous TypeCVE-2025-53213 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditional Shipping elex-reachship-multi-carrier-conditional-shipping allows Using Malicious Files.This issue affects ReachShip WooCommerce Multi-Carrier & Conditional Shipping: from n/a through <= 4.3.1.
Product
ReachShip WooCommerce Multi-Carrier & Conditional Shipping
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update ReachShip WooCommerce Multi-Carrier & Conditional Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025myCred: Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2025-54667 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Saad Iqbal myCred mycred allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.This issue affects myCred: from n/a through <= 2.9.4.3.
Product
myCred
Affected
up to 2.9.4.3
What to do
Affects up to 2.9.4.3. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2025-8874 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.0.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Affected
up to 2.0.8.6
What to do
Affects up to 2.0.8.6. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 22, 2025Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection): Arbitrary file deletionCVE-2025-7645 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete-file' field in all versions up to, and including, 3.2.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, when an administrator deletes the submission, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 18, 2025Crowdfunding for WooCommerce: Stored Cross-Site ScriptingCVE-2025-5767 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Crowdfunding for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Crowdfunding for WooCommerce
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update Crowdfunding for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 16, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2025-5284 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Affected
up to 2.0.8.2
What to do
Affects up to 2.0.8.2. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2025IndieBlocks: Stored Cross-Site ScriptingCVE-2025-5950 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
IndieBlocks
Affected
up to 0.13.2
What to do
Affects up to 0.13.2. Update IndieBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2025PayU India: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31022 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU India: from n/a through < 3.8.8.
Product
PayU India
What to do
Update PayU India to the newest version.
Full record and what to do →NVD record patchstack.com
May 19, 2025Syndicate Out: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43836 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in confuzzledduck Syndicate Out syndicate-out allows Reflected XSS.This issue affects Syndicate Out: from n/a through <= 0.9.
Product
Syndicate Out
Affected
up to 0.9
What to do
Affects up to 0.9. Update Syndicate Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 9, 2025Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode: Unauthorized access of dataCVE-2025-3949 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'seedprod_lite_get_revisisons' function in all versions up to, and including, 6.18.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the content of arbitrary landing page revisions.
Product
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
Affected
up to 6.18.15
What to do
Affects up to 6.18.15. Update Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.