Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

274 results · page 2 of 6

Feb 20, 2026WPLegalPages: Missing AuthorizationCVE-2025-67974 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Legal Pages WPLegalPages wplegalpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLegalPages: from n/a through <= 3.5.4.
Product
WPLegalPages
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update WPLegalPages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 28, 2026Passster – Password Protect Pages and Content: Stored Cross-Site ScriptingCVE-2025-14865 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortcode in all versions up to, and including, 4.2.24. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.2.21.
Product
Passster – Password Protect Pages and Content
Affected
up to 4.2.24
What to do
Affects up to 4.2.24. Update Passster – Password Protect Pages and Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49055 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.
Product
WP Lead Capturing Pages
Affected
up to 2.5
What to do
Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49050 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.
Product
WP Lead Capturing Pages
Affected
up to 2.5
What to do
Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unauthorized Arbitrary Media ReplacementCVE-2025-12640 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library.
Product
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026AMP for WP – Accelerated Mobile Pages: Cross-Site Request ForgeryCVE-2025-14468 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to inverted nonce verification logic in the amp_theme_ajaxcomments AJAX handler, which rejects requests with VALID nonces and accepts requests with MISSING or INVALID nonces. This makes it possible for unauthenticated attackers to submit comments on behalf of logged-in users via a forged request granted they can trick a user into performing an action such as clicking on a link, and the plugin's template mode is enabled.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026WP Js List Pages Shortcodes: Stored Cross-Site ScriptingCVE-2025-14110 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Js List Pages Shortcodes
Affected
up to 1.21
What to do
Affects up to 1.21. Update WP Js List Pages Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Moosend Landing Pages: Unauthorized modification of dataCVE-2025-13496 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Moosend Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the moosend_landings_auth_get function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the 'moosend_landing_api_key' option value.
Product
Moosend Landing Pages
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Moosend Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 31, 2025Core Web Vitals & PageSpeed Booster: Missing AuthorizationCVE-2025-62144 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mohammed Kaludi Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through <= 1.0.28.
Product
Core Web Vitals & PageSpeed Booster
Affected
up to 1.0.28
What to do
Affects up to 1.0.28. Update Core Web Vitals & PageSpeed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 15, 2025CC Child Pages: Stored Cross-Site ScriptingCVE-2025-13608 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'child_pages' shortcode in all versions up to, and including, 2.0.0. This is due to insufficient input sanitization and output escaping on four user-supplied attributes (use_custom_link, use_custom_link_target, use_custom_thumbs, and use_custom_excerpt) in the 'show_child_pages' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CC Child Pages
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update CC Child Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025MediaCommander – Bring Folders to Media, Posts, and Pages: Unauthorized data deletionCVE-2025-14508 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files` capability check (Author level) for a destructive operation that can delete all folders. This makes it possible for authenticated attackers, with Author-level access and above, to delete all folder organization data created by Administrators and other users.
Product
MediaCommander – Bring Folders to Media, Posts, and Pages
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update MediaCommander – Bring Folders to Media, Posts, and Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2025Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unauthorized modification of dataCVE-2025-12971 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders.
Product
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025Legal Pages: Missing AuthorizationCVE-2025-66077 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.6.
Product
Legal Pages
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2025-11815 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.08
What to do
Affects up to 3.5.08. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025Display Pages Shortcode: Stored Cross-Site ScriptingCVE-2025-11763 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Display Pages Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column_count' parameter in the [display-pages] shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Display Pages Shortcode
Affected
up to 1.1
What to do
Affects up to 1.1. Update Display Pages Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2025-11003 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_ui_template' function in all versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with Subscriber-level access and above, to save templates that contain custom JavaScript.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.09
What to do
Affects up to 3.5.09. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 13, 2025Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed: Unauthorized modification of dataCVE-2025-12015 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_wpqai_disconnect_quicq_afosto' AJAX endpoint in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect Afosto
Product
Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 31, 2025Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Unauthorized modification of dataCVE-2025-11816 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disconnect_account_request() function in all versions up to, and including, 3.5.1. This makes it possible for unauthenticated attackers to disconnect the site from its API plan.
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 26, 2025Simple Content Templates for Blog Posts & Pages: Cross-Site Request Forgery (CSRF)CVE-2025-62958 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Clifton Griffin Simple Content Templates for Blog Posts & Pages simple-post-template allows Cross Site Request Forgery.This issue affects Simple Content Templates for Blog Posts & Pages: from n/a through <= 2.2.61.
Product
Simple Content Templates for Blog Posts & Pages
Affected
up to 2.2.61
What to do
Affects up to 2.2.61. Update Simple Content Templates for Blog Posts & Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Advanced Custom Fields : CPT Options Pages: Cross-Site Request Forgery (CSRF)CVE-2025-60208 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Tusko Trush Advanced Custom Fields : CPT Options Pages acf-cpt-options-pages allows Object Injection.This issue affects Advanced Custom Fields : CPT Options Pages: from n/a through <= 2.0.9.
Product
Advanced Custom Fields : CPT Options Pages
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Advanced Custom Fields : CPT Options Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Map Categories to Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60146 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amit Verma Map Categories to Pages map-categories-to-pages allows Stored XSS.This issue affects Map Categories to Pages: from n/a through <= 1.3.2.
Product
Map Categories to Pages
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Map Categories to Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Show Pages List: Cross-Site Request Forgery (CSRF)CVE-2025-58219 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in LIJE Show Pages List show-pages-list allows Cross Site Request Forgery.This issue affects Show Pages List: from n/a through <= 1.2.0.
Product
Show Pages List
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Show Pages List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025List Child Pages Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58021 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr List Child Pages Shortcode list-child-pages-shortcode allows Stored XSS.This issue affects List Child Pages Shortcode: from n/a through <= 1.3.1.
Product
List Child Pages Shortcode
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update List Child Pages Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Append extensions on Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57940 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh Kumar Mukhiya Append extensions on Pages append-extensions-on-pages allows Stored XSS.This issue affects Append extensions on Pages: from n/a through <= 1.1.2.
Product
Append extensions on Pages
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Append extensions on Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 20, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: SQL InjectionCVE-2025-10002 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function in all versions up to, and including, 2.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower level users if access to the plugin is granted.
Product
ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 18, 2025Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Unauthorized access of functionalityCVE-2025-8565 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplp_gdpr_install_plugin_ajax_handler() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to install arbitrary repository plugins.
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 5, 2025Widgetize Pages Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58805 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
Product
Widgetize Pages Light
Affected
up to 3.0
What to do
Affects up to 3.0. Update Widgetize Pages Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2025List Subpages: Stored Cross-Site ScriptingCVE-2025-8290 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
List Subpages
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update List Subpages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 14, 2025WP Lead Capturing Pages: Missing AuthorizationCVE-2025-31425 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.
Product
WP Lead Capturing Pages
What to do
Update WP Lead Capturing Pages to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025PPWP – Password Protect Pages: 1CVE-2025-5998 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.
Product
PPWP – Password Protect Pages
Fixed in
1.9.11
What to do
Update PPWP – Password Protect Pages to 1.9.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 16, 2025Dot html,php,xml etc pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52779 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.
Product
Dot html,php,xml etc pages
Affected
up to 1.0
What to do
Affects up to 1.0. Update Dot html,php,xml etc pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31424 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.
Product
WP Lead Capturing Pages
What to do
Update WP Lead Capturing Pages to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Widgetize Pages Light: Cross-Site Request Forgery (CSRF)CVE-2025-30995 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
Product
Widgetize Pages Light
Affected
up to 3.0
What to do
Affects up to 3.0. Update Widgetize Pages Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Legal Pages: Missing AuthorizationCVE-2025-48242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.5.
Product
Legal Pages
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Dot html,php,xml etc pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48112 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.
Product
Dot html,php,xml etc pages
Affected
up to 1.0
What to do
Affects up to 1.0. Update Dot html,php,xml etc pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Ninja Pages: Does not sanitise and escape some of its settingsCVE-2025-1454 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ninja Pages
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Ninja Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2024-8759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Nested Pages
Fixed in
3.2.9
What to do
Update Nested Pages to 3.2.9 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Remote Code ExecutionCVE-2025-3053 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uip_process_form_input() function. This is due to the function taking user supplied inputs to execute arbitrary functions with arbitrary data, and does not have any sort of capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.07
What to do
Affects up to 3.5.07. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2025Xavin's List Subpages: Stored Cross-Site ScriptingCVE-2025-4220 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Xavin's List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xls' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Xavin's List Subpages
Affected
up to 1.3
What to do
Affects up to 1.3. Update Xavin's List Subpages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 1, 2025Nautic Pages: Stored Cross-Site ScriptingCVE-2025-4100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Nautic Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'np_marinetraffic_map' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Nautic Pages
Affected
up to 2.0
What to do
Affects up to 2.0. Update Nautic Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2025Landing pages and Domain aliases for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46533 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdrift.no Landing pages and Domain aliases for WordPress landing-pages-and-domain-aliases allows Stored XSS.This issue affects Landing pages and Domain aliases for WordPress: from n/a through <= 0.8.
Product
Landing pages and Domain aliases for
Affected
up to 0.8
What to do
Affects up to 0.8. Update Landing pages and Domain aliases for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Mobile Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32625 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Mobile Pages mobile-pages allows Reflected XSS.This issue affects Mobile Pages: from n/a through <= 1.0.2.
Product
Mobile Pages
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin foCVE-2025-3453 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'password_protected_cookie' function. This makes it possible for unauthenticated attackers to extract sensitive data including all protected site content if the 'Use Transient' setting is enabled.
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2025Widgetize Pages Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32117 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
Product
Widgetize Pages Light
Affected
up to 3.0
What to do
Affects up to 3.0. Update Widgetize Pages Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Pages Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31445 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sed Lex Pages Order pages-order allows Reflected XSS.This issue affects Pages Order: from n/a through <= 1.1.3.
Product
Pages Order
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Pages Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 23, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2025-0718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Nested Pages
Fixed in
3.2.13
What to do
Update Nested Pages to 3.2.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of data that can lead to privilege escalationCVE-2025-1309 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the uip_save_form_as_option() function in all versions up to, and including, 3.5.04. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.04
What to do
Affects up to 3.5.04. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 3, 2025Explore pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mbyte Explore pages explore-pages allows Reflected XSS.This issue affects Explore pages: from n/a through <= 1.01.
Product
Explore pages
Affected
up to 1.01
What to do
Affects up to 1.01. Update Explore pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 28, 2025BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages: Unauthorized accessCVE-2025-1780 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.25. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting.
Product
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
Affected
up to 3.4.25
What to do
Affects up to 3.4.25. Update BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages: Unauthorized accessCVE-2024-13358 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting.
Product
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
Affected
up to 3.4.24
What to do
Affects up to 3.4.24. Update BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.