Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

128 results · page 2 of 3

Jul 27, 2026Printcart Web to Print Product Designer for WooCommerce: Does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization checkCVE-2025-15662 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.
Product
Printcart Web to Print Product Designer for WooCommerce
Fixed in
2.5.3
What to do
Update Printcart Web to Print Product Designer for WooCommerce to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not consistently enforce the role restriction configured on its front-end registration role-selection fieldCVE-2026-12497 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some valid ways of configuring the offered roles the handler ignores the restriction and falls back to accepting any non-administrator role. Combined with the absence of a nonce on the public registration handler, this allows an unauthenticated visitor to register an account with a higher role, such as Editor or Author, than the form was configured to offer.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.16.18
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.16.18 or newer.
Full record and what to do →NVD record wpscan.com
Jul 22, 2026Timetics: Does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gatewaysCVE-2026-14322 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.
Product
Timetics
Fixed in
1.0.57
What to do
Update Timetics to 1.0.57 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to byCVE-2026-65051 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 20, 2026Social Login, Passkeys, Magic Link & Email OTP: Does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verificationCVE-2026-13142 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
Product
Social Login, Passkeys, Magic Link & Email OTP
Fixed in
1.4.1
What to do
Update Social Login, Passkeys, Magic Link & Email OTP to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026Anti-Malware Security and Brute-Force Firewall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57691 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through <= 4.23.89.
Product
Anti-Malware Security and Brute-Force Firewall
Affected
up to 4.23.89
What to do
Affects up to 4.23.89. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026User Registration & Membership: Does not enforce payment completion before activating a paid membership subscriptionCVE-2026-11965 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription, allowing unauthenticated users (after self-registering an account through the open registration flow) to obtain an active subscription on any paid plan without paying and access the gated content.
Product
User Registration & Membership
Fixed in
5.2.0
What to do
Update User Registration & Membership to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Jun 24, 2026Cornerstone: Does not enforce capability checks on one of its CSS-preview request handlersCVE-2026-9710 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.8 (v0.8.x) on the .org repository.
Product
Cornerstone
Fixed in
7.8.8
What to do
Update Cornerstone to 7.8.8 or newer.
Full record and what to do →NVD record wpscan.com
Jun 24, 2026Cornerstone: Does not enforce capability checks on one of its REST API routesCVE-2026-9709 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.9 (v0.8.x) on the .org repository.
Product
Cornerstone
Fixed in
7.8.9
What to do
Update Cornerstone to 7.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 23, 2026Frontend File Manager: Does not properly enforce its nonce check on the file download handlerCVE-2026-8379 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.
Product
Frontend File Manager
Affected
up to 23.6
What to do
Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 19, 2026WP Hotel Booking: Does not enforce capability checks in several of its AJAX handlersCVE-2026-9822 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
Product
WP Hotel Booking
Fixed in
2.3.1
What to do
Update WP Hotel Booking to 2.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.CVE-2026-49109 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.CVE-2026-39478 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.
Affected
up to 4.23.87
What to do
Affects up to 4.23.87. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026WP Go Maps: Does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables routeCVE-2026-8385 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.
Product
WP Go Maps
Fixed in
10.0.10
What to do
Update WP Go Maps to 10.0.10 or newer.
Full record and what to do →NVD record wpscan.com
Jun 2, 2026Really Simple Security: Does not enforce the second-factor challenge in two of its two-factor authentication REST endpointsCVE-2026-8293 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.
Product
Really Simple Security
Fixed in
9.5.10.1
What to do
Update Really Simple Security to 9.5.10.1 or newer.
Full record and what to do →NVD record wpscan.com
May 16, 2026WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to reaCVE-2021-47977 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the file parameter. Attackers can send requests to the duplicator_download action via admin-ajax.php with path traversal sequences to access sensitive system files outside the intended directory.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record gotmls.net gotmls.net
Mar 5, 2026Login with Salesforce: Does not validate that users are allowed to login through SalesforceCVE-2026-2418 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
Product
Login with Salesforce
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Login with Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 23, 2026Orchid Store: Missing AuthorizationCVE-2026-24612 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orchid Store: from n/a through <= 1.5.15.
Product
Orchid Store
Affected
up to 1.5.15
What to do
Affects up to 1.5.15. Update Orchid Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 10, 2026ConvertForce Popup Builder: Stored Cross-Site ScriptingCVE-2025-14506 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ConvertForce Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gutenberg block's `entrance_animation` attribute in all versions up to, and including, 0.0.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ConvertForce Popup Builder
Affected
up to 0.0.7
What to do
Affects up to 0.0.7. Update ConvertForce Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025WP Gravity Forms Salesforce: Deserialization of Untrusted DataCVE-2025-60180 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Object Injection.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.5.1.
Product
WP Gravity Forms Salesforce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update WP Gravity Forms Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: Missing AuthorizationCVE-2025-67468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: from n/a through <= 1.4.6.
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 24, 2025The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing themCVE-2025-12628 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Oct 29, 2025Anti-Malware Security and Brute-Force Firewall: Arbitrary File ReadCVE-2025-11705 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Anti-Malware Security and Brute-Force Firewall
Affected
up to 4.23.81
What to do
Affects up to 4.23.81. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 22, 2025WP-Force Images Download: Stored Cross-Site ScriptingCVE-2025-11809 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including, 1.8. This is due to insufficient input sanitization and output escaping on the 'class' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Force Images Download
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP-Force Images Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2025Force Update Translations: Cross-Site Request Forgery (CSRF)CVE-2025-58236 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mayo Moriyama Force Update Translations force-update-translations allows Cross Site Request Forgery.This issue affects Force Update Translations: from n/a through <= 0.5.
Product
Force Update Translations
Affected
up to 0.5
What to do
Affects up to 0.5. Update Force Update Translations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025To Lead For Salesforce: Cross-Site Request Forgery (CSRF)CVE-2025-58809 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nick Ciske To Lead For Salesforce salesforce-wordpress-to-lead allows Reflected XSS.This issue affects To Lead For Salesforce: from n/a through <= 2.7.3.9.
Product
To Lead For Salesforce
Affected
up to 2.7.3.9
What to do
Affects up to 2.7.3.9. Update To Lead For Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025WP Gravity Forms Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30953 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.4.7.
Product
WP Gravity Forms Salesforce
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update WP Gravity Forms Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 30, 2025Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: Full Path DisclosureCVE-2025-4659 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 7, 2025Integration for WooCommerce and Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n/a through <= 1.7.5.
Product
Integration for WooCommerce and Salesforce
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Integration for WooCommerce and Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025WS Force Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46521 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Silver Muru WS Force Login Page ws-force-login-page allows Stored XSS.This issue affects WS Force Login Page: from n/a through <= 3.0.3.
Product
WS Force Login Page
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update WS Force Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025BruteGuard – Brute Force Login Protection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39408 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection bruteguard allows Reflected XSS.This issue affects BruteGuard – Brute Force Login Protection: from n/a through <= 0.1.4.
Product
BruteGuard – Brute Force Login Protection
Affected
up to 0.1.4
What to do
Affects up to 0.1.4. Update BruteGuard – Brute Force Login Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Buddypress Force Password Change: Authenticated account takeoverCVE-2025-3793 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bp_force_password_ajax' function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with subscriber-level access and above and under certain prerequisites, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their accounts.
Product
Buddypress Force Password Change
Affected
up to 0.1
What to do
Affects up to 0.1. Update Buddypress Force Password Change to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2025WordPress Report Brute Force Attacks and Login Protection ReportAttacks: SQL InjectionCVE-2025-2250 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WordPress Report Brute Force Attacks and Login Protection ReportAttacks
Affected
up to 2.32
What to do
Affects up to 2.32. Update WordPress Report Brute Force Attacks and Login Protection ReportAttacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025LTL Freight Quotes – TForce Edition: SQL InjectionCVE-2024-13478 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LTL Freight Quotes – TForce Edition
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update LTL Freight Quotes – TForce Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2025WordPress-to-candidate for Salesforce CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23657 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RusAlex WordPress-to-candidate for Salesforce CRM salesforce-wordpress-to-candidate allows Reflected XSS.This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through <= 1.0.1.
Product
WordPress-to-candidate for Salesforce CRM
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WordPress-to-candidate for Salesforce CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 22, 2024WordPress Brute Force Protection – Stop Brute Force Attacks: Reflected Cross-Site ScriptingCVE-2024-10869 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WordPress Brute Force Protection – Stop Brute Force Attacks
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update WordPress Brute Force Protection – Stop Brute Force Attacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2024WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: Missing AuthorizationCVE-2024-44020 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through <= 1.2.7.
Product
WP Free SSL – Free SSL Certificate for WordPress and force HTTPS
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WP Free SSL – Free SSL Certificate for WordPress and force HTTPS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 8, 2024Orchid Store: Unauthorized modification of dataCVE-2024-6987 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_store_activate_plugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Addonify Floating Cart For WooCommerce plugin if it is installed.
Product
Orchid Store
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Orchid Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Jun 8, 2024WP Force SSL & HTTPS SSL Redirect: Unauthorized modification of dataCVE-2024-5770 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.
Product
WP Force SSL & HTTPS SSL Redirect
Affected
up to 1.66
What to do
Affects up to 1.66. Update WP Force SSL & HTTPS SSL Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2024Integration for Contact Form 7 and Salesforce: Cross-Site Request Forgery (CSRF)CVE-2024-34755 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Contact Form 7 and Salesforce.This issue affects Integration for Contact Form 7 and Salesforce: from n/a through 1.3.9.
Product
Integration for Contact Form 7 and Salesforce
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Integration for Contact Form 7 and Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Wp Ultimate Review: Client-Side Enforcement of Server-Side SecurityCVE-2024-32685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
Product
Wp Ultimate Review
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Zero Spam: Client-Side Enforcement of Server-Side SecurityCVE-2024-32521 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zero Spam: from n/a through 5.5.6.
Product
Zero Spam
Affected
up to 5.5.6
What to do
Affects up to 5.5.6. Update Zero Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024weForms: Client-Side Enforcement of Server-Side SecurityCVE-2024-32512 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20.
Product
weForms
Affected
up to 1.6.20
What to do
Affects up to 1.6.20. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Anti-Malware Security and Brute-Force Firewall: Improper Control of Generation of Code ('Code Injection')CVE-2024-22144 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Eli Scheetz Anti-Malware Security and Brute-Force Firewall gotmls allows Code Injection.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through 4.21.96.
Product
Anti-Malware Security and Brute-Force Firewall
Affected
up to 4.21.96
What to do
Affects up to 4.21.96. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score: Sensitive Information ExposureCVE-2023-7046 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated attackers to extract sensitive data including TLS Certificate Private Keys
Product
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score
Affected
up to 7.0
What to do
Affects up to 7.0. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 19, 2024Restrict User Access – Membership Plugin with Force: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29138 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joachim Jensen Restrict User Access – Membership Plugin with Force restrict-user-access.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through <= 2.5.
Product
Restrict User Access – Membership Plugin with Force
Affected
up to 2.5
What to do
Affects up to 2.5. Update Restrict User Access – Membership Plugin with Force to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Solid Security – Password, Two Factor Authentication, and Brute Force Protection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-28786 · WordPress plugins & themes · reported by PatchstackLow 3.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.
Product
Solid Security – Password, Two Factor Authentication, and Brute Force Protection
Affected
up to 8.1.4
What to do
Affects up to 8.1.4. Update Solid Security – Password, Two Factor Authentication, and Brute Force Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023WordPress Brute Force Protection – Stop Brute Force Attacks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-48764 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection WordPress Brute Force Protection – Stop Brute Force Attacks.This issue affects WordPress Brute Force Protection – Stop Brute Force Attacks: from n/a through 2.2.5.
Product
WordPress Brute Force Protection – Stop Brute Force Attacks
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WordPress Brute Force Protection – Stop Brute Force Attacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-37982 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.CVE-2023-28419 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.
Affected
up to 1.2
What to do
Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.