Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

477new WordPress flaws this week

390,525entries in the database

243 results · page 2 of 5

Aug 6, 2026DataPress (Dataverse Integration): Does not properly restrict access to its template rendering feature and exposes the viewing user's data to itCVE-2026-5336 · WordPress plugins & themes · reported by WPScanMedium 6.8
The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.
Product
DataPress (Dataverse Integration)
Fixed in
2.91
What to do
Update DataPress (Dataverse Integration) to 2.91 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.CVE-2026-28179 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
Affected
up to 1.33.0
What to do
Affects up to 1.33.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 2, 2026Narrative Publisher: Does not restrict write access to a REST-exposed post meta field or escape itCVE-2026-16273 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the affected post.
Product
Narrative Publisher
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Narrative Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026Clever Mega Menu for Visual Composer: Does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadataCVE-2026-11872 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.
Product
Clever Mega Menu for Visual Composer
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Clever Mega Menu for Visual Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026GiveWP: Does not restrict the set of available payment gateways to those enabled by the administratorCVE-2026-14317 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.
Product
GiveWP
Fixed in
4.16.3
What to do
Update GiveWP to 4.16.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.CVE-2026-65568 · WordPress plugins & themes · reported by PatchstackMedium 5
Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.
Affected
up to 45.15.0
What to do
Affects up to 45.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026MemberGlut: Does not validate the role chosen during front-end registrationCVE-2026-12394 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
Product
MemberGlut
Fixed in
1.1.5
What to do
Update MemberGlut to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Jul 15, 2026Shibboleth: Does not fail closedCVE-2026-12281 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach the application, an unauthenticated attacker can log in with forged identity headers and, when automatic account creation and the default administrator role mapping are enabled, create and sign in as a new administrator. Exploitation requires the non-default HTTP header attribute mode, an empty or absent spoof key, automatic account creation enabled, and a deployment that does not strip untrusted client headers before they reach the application.
Product
Shibboleth
Fixed in
2.5.4
What to do
Update Shibboleth to 2.5.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57734 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.
Product
tagDiv Composer
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 10, 2026Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms: Local File InclusionCVE-2025-11977 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
Affected
up to 1.26.12
What to do
Affects up to 1.26.12. Update Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jun 30, 2026Premium Addons for KingComposer: Unauthorized modification and loss of dataCVE-2026-12349 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification and loss of data in versions up to, and including, 1.1.1. This is due to missing authorization and capability checks on the add_custom_sidebar() and remove_custom_sidebar() AJAX handlers, both of which are exposed through wp_ajax_nopriv_* hooks and write directly to the octagon_custom_sidebar option via update_option(). This makes it possible for unauthenticated attackers to create arbitrary custom widget areas or delete existing custom sidebars, which can cause widgets assigned to those areas to silently lose their registration and stop rendering.
Product
Premium Addons for KingComposer
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Premium Addons for KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2026WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by eCVE-2019-25738 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.framework-y.com wordpress.framework-y.com
Apr 8, 2026tagDiv Composer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39712 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer td-composer allows Code Injection.This issue affects tagDiv Composer: from n/a through <= 5.4.3.
Product
tagDiv Composer
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39692 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Stored XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.
Product
tagDiv Composer
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2026Restaurant Cafeteria: Exposes insecure admin-ajax actions without nonce or capability checksCVE-2025-15445 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscriber, to perform privileged operations. An attacker can install and activate a from a user-supplied URL, leading to arbitrary PHP code execution, and also import demo content that rewrites site configuration, including Restaurant Cafeteria WordPress theme through 0.4.6_mods, pages, menus, and front page settings.
Product
Restaurant Cafeteria
Affected
up to 0.4.6
What to do
Affects up to 0.4.6. Update Restaurant Cafeteria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 25, 2026Rosebud: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27081 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Rosebud rosebud allows PHP Local File Inclusion.This issue affects Rosebud: from n/a through <= 1.4.
Product
Rosebud
Affected
up to 1.4
What to do
Affects up to 1.4. Update Rosebud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50001 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2.
Product
tagDiv Composer
Affected
up to 5.4.2
What to do
Affects up to 5.4.2. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin optCVE-2026-22203 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 11, 2026Datalogics Ecommerce Delivery: Exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verificationCVE-2026-2631 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.
Product
Datalogics Ecommerce Delivery
Fixed in
2.6.60
What to do
Update Datalogics Ecommerce Delivery to 2.6.60 or newer.
Full record and what to do →NVD record wpscan.com
Mar 5, 2026ElectroServ: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22435 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes ElectroServ electroserv allows PHP Local File Inclusion.This issue affects ElectroServ: from n/a through <= 1.3.2.
Product
ElectroServ
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update ElectroServ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 28, 2026wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_closeCVE-2026-28555 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 23, 2026ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endCVE-2026-23693 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wpmet.com
Feb 20, 2026Business Template Blocks for WPBakery (Visual Composer) Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69390 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Business Template Blocks for WPBakery (Visual Composer) Page Builder templates-and-addons-for-wpbakery-page-builder allows Reflected XSS.This issue affects Business Template Blocks for WPBakery (Visual Composer) Page Builder: from n/a through <= 1.3.2.
Product
Business Template Blocks for WPBakery (Visual Composer) Page Builder
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Business Template Blocks for WPBakery (Visual Composer) Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026CMSMasters Content Composer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25326 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows PHP Local File Inclusion.This issue affects CMSMasters Content Composer: from n/a through <= 1.4.5.
Product
CMSMasters Content Composer
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update CMSMasters Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026CMSMasters Content Composer: Missing AuthorizationCVE-2026-23547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMSMasters Content Composer: from n/a through <= 2.5.8.
Product
CMSMasters Content Composer
Affected
up to 2.5.8
What to do
Affects up to 2.5.8. Update CMSMasters Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Rosebud: Authorization Bypass Through User-Controlled KeyCVE-2026-24631 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rosebud: from n/a through <= 1.4.
Product
Rosebud
Affected
up to 1.4
What to do
Affects up to 1.4. Update Rosebud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50005 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows DOM-Based XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2.
Product
tagDiv Composer
Affected
up to 5.4.2
What to do
Affects up to 5.4.2. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 20, 2026Bookingor: Exposes authenticated AJAX actions without capability or nonce checksCVE-2025-12573 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress plugin through 1.0.12 data.
Product
Bookingor
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Bookingor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 7, 2026Moosend Landing Pages: Unauthorized modification of dataCVE-2025-13496 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Moosend Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the moosend_landings_auth_get function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the 'moosend_landing_api_key' option value.
Product
Moosend Landing Pages
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Moosend Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 31, 2025Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30628 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.
Product
Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.2
What to do
Affects up to 1.2. Update Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Ultimate Post Kit Addons for Elementor: Exposes multiple AJAX “load more” endpoints suchCVE-2025-14434 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.
Product
Ultimate Post Kit Addons for Elementor
Fixed in
4.0.16
What to do
Update Ultimate Post Kit Addons for Elementor to 4.0.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 24, 2025Page Builder: Live Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22.
Product
Page Builder: Live Composer
Affected
up to 2.1.22
What to do
Affects up to 2.1.22. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025WPBakery Visual Composer WHMCS Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68574 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows DOM-Based XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through <= 1.0.4.3.
Product
WPBakery Visual Composer WHMCS Elements
Affected
up to 1.0.4.3
What to do
Affects up to 1.0.4.3. Update WPBakery Visual Composer WHMCS Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 20, 2025Live Composer – Free WordPress Website Builder: PHP Object InjectionCVE-2025-14071 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via deserialization of untrusted input in the dslc_module_posts_output shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Live Composer – Free WordPress Website Builder
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Live Composer – Free WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 20, 2025FiboSearch – Ajax Search for WooCommerce: Stored Cross-Site ScriptingCVE-2025-14298 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in all versions up to, and including, 1.32.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires TheGem theme (premium) to be installed with Header Builder mode enabled, and the FiboSearch "Replace search bars" option enabled for TheGem integration.
Product
FiboSearch – Ajax Search for WooCommerce
Affected
up to 1.32.0
What to do
Affects up to 1.32.0. Update FiboSearch – Ajax Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2025Live Composer – Free WordPress Website Builder: Multiple Stored Cross-Site Scripting vulnerabilitiesCVE-2025-13537 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to multiple Stored Cross-Site Scripting vulnerabilities via DOM manipulation in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Live Composer – Free WordPress Website Builder
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Live Composer – Free WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025App Landing Template Blocks for WPBakery (Visual Composer) Page Builder: Stored Cross-Site ScriptingCVE-2025-14119 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_video_play' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
App Landing Template Blocks for WPBakery (Visual Composer) Page Builder
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update App Landing Template Blocks for WPBakery (Visual Composer) Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 24, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Time-based SQL InjectionCVE-2025-7402 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in all versions up to, and including, 4.95 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.95
What to do
Affects up to 4.95. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 18, 2025Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links: Unauthorized post modificationCVE-2025-11734 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization in all versions up to, and including, 1.2.5. This is due to the plugin registering a REST API endpoint that only checks for a broad capability (aioseo_blc_broken_links_page) that is granted to contributor level users, without verifying the user's permission to perform actions on the specific post being targeted. This makes it possible for authenticated attackers, with contributor level access and above, to trash arbitrary posts via the DELETE /wp-json/aioseoBrokenLinkChecker/v1/post endpoint.
Product
Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 6, 2025tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62031 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.
Product
tagDiv Composer
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62030 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.
Product
tagDiv Composer
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Open Close WooCommerce Store: Missing AuthorizationCVE-2025-62935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Close WooCommerce Store: from n/a through <= 5.0.0.
Product
Open Close WooCommerce Store
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 2, 2025Ajax WooSearch: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9697 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Ajax WooSearch
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ajax WooSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 20, 2025ThemeMakers Visual Content Composer: Deserialization of Untrusted DataCVE-2025-53299 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmm_content_composer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through <= 1.5.8.
Product
ThemeMakers Visual Content Composer
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update ThemeMakers Visual Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-55709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through < 45.15.0.
Product
Visual Composer Website Builder
What to do
Update Visual Composer Website Builder to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Premium Addons for KingComposer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49036 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in octagonwebstudio Premium Addons for KingComposer premium-addons-for-kingcomposer allows PHP Local File Inclusion.This issue affects Premium Addons for KingComposer: from n/a through <= 1.1.1.
Product
Premium Addons for KingComposer
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Premium Addons for KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2025FiboSearch: Missing AuthorizationCVE-2025-47444 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiboSearch: from n/a through <= 1.32.1.
Product
FiboSearch
Affected
up to 1.32.1
What to do
Affects up to 1.32.1. Update FiboSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 8, 2025OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-6572 · WordPress plugins & themes · reported by WPScanMedium 5.9
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 15, 2025Alone – Charity Multipurpose Non-profit: Arbitrary file uploadsCVE-2025-5394 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. CVE-2025-54019 is likely a duplicate of this.
Product
Alone – Charity Multipurpose Non-profit
Affected
up to 7.8.3
What to do
Affects up to 7.8.3. Update Alone – Charity Multipurpose Non-profit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 15, 2025Alone – Charity Multipurpose Non-profit: Arbitrary file deletionCVE-2025-5393 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This was partially patched in 7.8.5 and has been fully addresses in 7.8.7.
Product
Alone – Charity Multipurpose Non-profit
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update Alone – Charity Multipurpose Non-profit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.