Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

105 results · page 2 of 3

Jun 6, 2025Knowledge Base: Stored Cross-Site ScriptingCVE-2025-5533 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Knowledge Base
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 7, 2025Easy PayPal Buy Now Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47623 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button wp-ecommerce-paypal allows Stored XSS.This issue affects Easy PayPal Buy Now Button: from n/a through <= 2.0.
Product
Easy PayPal Buy Now Button
Affected
up to 2.0
What to do
Affects up to 2.0. Update Easy PayPal Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Call Now PHT Blog: Cross-Site Request Forgery (CSRF)CVE-2025-46492 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pham Thanh Call Now PHT Blog call-now-coccoc-pht-blog allows Stored XSS.This issue affects Call Now PHT Blog: from n/a through <= 2.4.1.
Product
Call Now PHT Blog
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Call Now PHT Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Icegram Express formerly known as Email Subscribers: Does not sanitise and escape some of its settingsCVE-2024-11924 · WordPress plugins & themes · reported by WPScanLow 3.5
The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Icegram Express formerly known as Email Subscribers
Fixed in
5.7.52
What to do
Update Icegram Express formerly known as Email Subscribers to 5.7.52 or newer.
Full record and what to do →NVD record wpscan.com
Apr 4, 2025KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base: Sensitive Information ExposureCVE-2024-13604 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
Product
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 3, 2025Snow Storm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30858 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected XSS.This issue affects Snow Storm: from n/a through <= 1.4.6.
Product
Snow Storm
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Snow Storm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 27, 2025Login Me Now: Authentication bypassCVE-2025-1717 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own.
Product
Login Me Now
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Login Me Now to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 24, 2025WP Social SEO Booster – Knowledge Graph Social Signals SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel WP Social SEO Booster – Knowledge Graph Social Signals SEO wp-social-seo-booster allows Stored XSS.This issue affects WP Social SEO Booster – Knowledge Graph Social Signals SEO: from n/a through <= 1.2.0.
Product
WP Social SEO Booster – Knowledge Graph Social Signals SEO
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WP Social SEO Booster – Knowledge Graph Social Signals SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 30, 2025Bulk Me Now!: Does not have CSRF checks in some placesCVE-2024-12709 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
Product
Bulk Me Now!
Affected
up to 2.0
What to do
Affects up to 2.0. Update Bulk Me Now! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2025Bulk Me Now!: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-12708 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Bulk Me Now! WordPress plugin through 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Bulk Me Now!
Affected
up to 2.0
What to do
Affects up to 2.0. Update Bulk Me Now! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2025Bulk Me Now!: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12638 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Bulk Me Now!
Affected
up to 2.0
What to do
Affects up to 2.0. Update Bulk Me Now! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2025Call Now Button: Cross-Site Request Forgery (CSRF)CVE-2025-24738 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jerry Rietveld Call Now Button call-now-button allows Cross Site Request Forgery.This issue affects Call Now Button: from n/a through <= 1.4.13.
Product
Call Now Button
Affected
up to 1.4.13
What to do
Affects up to 1.4.13. Update Call Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Call me Now: Cross-Site Request Forgery (CSRF)CVE-2025-23745 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Tussendoor B.V. Call me Now call-me-now allows Stored XSS.This issue affects Call me Now: from n/a through <= 1.0.5.
Product
Call me Now
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Call me Now to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 4, 2024Knowledge Base documentation & wiki plugin – BasePress Docs: Unauthorized modification of dataCVE-2024-10664 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the basepress_db_posts_update() function in all versions up to, and including, 2.16.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the database.
Product
Knowledge Base documentation & wiki plugin – BasePress Docs
Affected
up to 2.16.3.3
What to do
Affects up to 2.16.3.3. Update Knowledge Base documentation & wiki plugin – BasePress Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 4, 2024Knowledge Base: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51677 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Knowledge Base knowledgebase allows Stored XSS.This issue affects Knowledge Base: from n/a through <= 2.2.0.
Product
Knowledge Base
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2024KB Support – WordPress Help Desk and Knowledge Base: Unauthorized access and modification of dataCVE-2024-8632 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'kbs_ajax_load_front_end_replies' and 'kbs_ajax_mark_reply_as_read' functions in all versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to read replies of any ticket, and mark any reply as read.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2024KB Support – WordPress Help Desk and Knowledge Base: Unauthorized modification and loss of dataCVE-2024-8548 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the /includes/ajax-functions.php file all versions up to, and including, 1.6.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple administrative actions, such as replying to arbitrary tickets, updating the status of any post, deleting any post, adding notes to tickets, flagging or unflagging tickets, and adding or removing ticket participants.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 19, 2024Easy PayPal Buy Now Button: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-43236 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: from n/a through 1.9.
Product
Easy PayPal Buy Now Button
Affected
up to 1.9
What to do
Affects up to 1.9. Update Easy PayPal Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 21, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5448 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
Affected
up to 1.7
What to do
Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Does not sanitise and escape some of its settingsCVE-2024-5447 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
Affected
up to 1.7
What to do
Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 22, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Stored Cross-Site ScriptingCVE-2024-3065 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE-2024-5447 may be a duplicate of this issue.
Product
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
Affected
up to 1.7
What to do
Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 29, 2024Knowledge Base documentation & wiki plugin – BasePress: Missing AuthorizationCVE-2024-33588 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
Product
Knowledge Base documentation & wiki plugin – BasePress
Affected
up to 2.16.1
What to do
Affects up to 2.16.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Knowledge Base documentation & wiki plugin – BasePress: Server-Side Request Forgery (SSRF)CVE-2024-33590 · WordPress plugins & themes · reported by PatchstackMedium 5
Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
Product
Knowledge Base documentation & wiki plugin – BasePress
Affected
up to 2.16.1
What to do
Affects up to 2.16.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Call Now Button: Does not sanitise and escape some of its settingsCVE-2024-2908 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Call Now Button
Fixed in
1.4.7
What to do
Update Call Now Button to 1.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 9, 2024BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2024-2845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024Knowledge Base for Documentation, FAQs with AI Assistance: Deserialization of Untrusted DataCVE-2024-24842 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2.
Product
Knowledge Base for Documentation, FAQs with AI Assistance
Affected
up to 11.30.2
What to do
Affects up to 11.30.2. Update Knowledge Base for Documentation, FAQs with AI Assistance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Easy PayPal & Stripe Buy Now Button: Cross-Site Request Forgery (CSRF)CVE-2023-51683 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal & Stripe Buy Now Button.This issue affects Easy PayPal & Stripe Buy Now Button: from n/a through 1.8.1.
Product
Easy PayPal & Stripe Buy Now Button
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Easy PayPal & Stripe Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Easy PayPal & Stripe Buy Now Button: Cross-Site Request ForgeryCVE-2024-1719 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_completion' function. This makes it possible for unauthenticated attackers to modify the plugins settings and chance the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy PayPal & Stripe Buy Now Button
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Easy PayPal & Stripe Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Index Now: Cross-Site Request ForgeryCVE-2024-0428 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Index Now plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.3. This is due to missing or incorrect nonce validation on the 'reset_form' function. This makes it possible for unauthenticated attackers to delete arbitrary site options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Index Now
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update Index Now to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 30, 2023KB Support – WordPress Help Desk and Knowledge Base: Missing AuthorizationCVE-2023-37890 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.5.88
What to do
Affects up to 1.5.88. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions.CVE-2023-47819 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条: Cross-Site Request Forgery (CSRF)CVE-2023-26531 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in 闪电博多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 allows Cross Site Request Forgery.This issue affects 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条: from n/a through 4.2.7.
Product
多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条
Affected
up to 4.2.7
What to do
Affects up to 4.2.7. Update 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in LOKALYZE CALL ME NOW plugin <= 3.0 versions.CVE-2023-32602 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in LOKALYZE CALL ME NOW plugin <= 3.0 versions.
Affected
up to 3.0
What to do
Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions.CVE-2023-5802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions.
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Call Now Accessibility Button: Does not sanitise and escape some of its settingsCVE-2023-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Call Now Accessibility Button
Fixed in
1.1
What to do
Update Call Now Accessibility Button to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023Call Now Accessibility Button: Does not properly sanitize some of its settingsCVE-2023-2028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Call Now Accessibility Button
Fixed in
1.1
What to do
Update Call Now Accessibility Button to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Easy PayPal Buy Now Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4628 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Easy PayPal Buy Now Button
Fixed in
1.7.4
What to do
Update Easy PayPal Buy Now Button to 1.7.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Call Now Button: Does not escape a parameter before outputting it back in an attribute of a hidden inputCVE-2022-1455 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled
Product
Call Now Button
Fixed in
1.1.2
What to do
Update Call Now Button to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021Business Hours Indicator: Does not sanitise or escape its 'Now closed message" settingCVE-2021-24593 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue
Product
Business Hours Indicator
Fixed in
2.3.5
What to do
Update Business Hours Indicator to 2.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability.CVE-2021-24305 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com targetfirst.com
Sep 16, 2019The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.CVE-2016-10971 · WordPress plugins & themes · reported by MITRECritical 9.8
The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
Product
MemberSonic Lite
Fixed in
1.302
What to do
Update MemberSonic Lite to 1.302 or newer.
Full record and what to do →NVD record pritect.net pritect.net
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.CVE-2016-5838 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
Fixed in
4.5.3
What to do
Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD record debian.org securityfocus.com
Jun 25, 2016The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of tCVE-2016-4828 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account.
Product
Collne Welcart e-Commerce
Fixed in
1.8.3
What to do
Update Collne Welcart e-Commerce to 1.8.3 or newer.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Mar 5, 2015Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.CVE-2014-9688 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
Product
Unspecified vulnerability in the Ninja Forms
Fixed in
2.8.10
What to do
Update Unspecified vulnerability in the Ninja Forms to 2.8.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Oct 13, 2014Unspecified vulnerability in the folder framework in the Enfold theme before 3.0.1 for WordPress has unknown impact and attack vectors.CVE-2014-7297 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in the folder framework in the Enfold theme before 3.0.1 for WordPress has unknown impact and attack vectors.
Product
Unspecified vulnerability in the folder framework in the Enfold
Fixed in
3.0.1
What to do
Update Unspecified vulnerability in the folder framework in the Enfold to 3.0.1 or newer.
Full record and what to do →NVD record themeforest.net wpvulndb.com
Jan 11, 2013Unspecified vulnerability in the Connections plugin before 0.7.1.6 for WordPress has unknown impact and attack vectors.CVE-2011-5254 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in the Connections plugin before 0.7.1.6 for WordPress has unknown impact and attack vectors.
Product
Unspecified vulnerability in the Connections
Fixed in
0.7.1.6
What to do
Update Unspecified vulnerability in the Connections to 0.7.1.6 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Sep 6, 2012Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads."CVE-2012-4874 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads."
Product
Unspecified vulnerability in the Another WordPress Classifieds
Fixed in
2.0
What to do
Update Unspecified vulnerability in the Another WordPress Classifieds to 2.0 or newer.
Full record and what to do →NVD record osvdb.org secunia.com
Jul 18, 2012Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.CVE-2012-4033 · WordPress plugins & themes · reported by MITREHigh 10
Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.
Product
Multiple unspecified vulnerabilities in the Zingiri Web Shop
Fixed in
2.4.0
What to do
Update Multiple unspecified vulnerabilities in the Zingiri Web Shop to 2.4.0 or newer.
Full record and what to do →NVD record forums.zingiri.com secunia.com
Apr 21, 2012Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.CVE-2012-2400 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org osvdb.org
Aug 10, 2011wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibCVE-2011-3130 · WordPress plugins & themes · reported by MITREHigh 7.5
wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection.
Fixed in
3.1.3
What to do
Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD record secunia.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.