Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

247 results · page 2 of 5

Jul 3, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versiCVE-2025-2537 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library (version 3.1.6) in various versions duCVE-2025-2540 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library (version 3.1.6) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versionCVE-2024-5647 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 27, 2025Katerio - Magazine: Path TraversalCVE-2025-52810 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.
Product
Katerio - Magazine
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Katerio - Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025Formulario de contacto SalesUp!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48143 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! formularios-de-contacto-salesup allows Reflected XSS.This issue affects Formulario de contacto SalesUp!: from n/a through <= 1.0.14.
Product
Formulario de contacto SalesUp!
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Formulario de contacto SalesUp! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 20, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in varioCVE-2024-5878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2025Rozario: Missing AuthorizationCVE-2025-31065 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: from n/a through 1.4.
Product
Rozario
Affected
up to 1.4
What to do
Affects up to 1.4. Update Rozario to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46261 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.9.0.
Product
Seriously Simple Podcasting
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Table Block by RioVizual: Cross-Site Request Forgery (CSRF)CVE-2025-32278 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wprio Table Block by RioVizual riovizual allows Cross Site Request Forgery.This issue affects Table Block by RioVizual: from n/a through <= 2.3.1.
Product
Table Block by RioVizual
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Table Block by RioVizual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Rio Video Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-31566 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in riosisgroup Rio Video Gallery rio-video-gallery allows Stored XSS.This issue affects Rio Video Gallery: from n/a through <= 2.3.6.
Product
Rio Video Gallery
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Rio Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5.CVE-2025-24982 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 23, 2025Gallerio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Subhasis Laha Gallerio gallerio allows Reflected XSS.This issue affects Gallerio: from n/a through <= 1.0.1.
Product
Gallerio
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Gallerio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Rio Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sabareesha Rio Photo Gallery rio-photo-gallery allows Reflected XSS.This issue affects Rio Photo Gallery: from n/a through <= 0.1.
Product
Rio Photo Gallery
Affected
up to 0.1
What to do
Affects up to 0.1. Update Rio Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 20, 2024Serious Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11108 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Serious Slider
Fixed in
1.2.7
What to do
Update Serious Slider to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Dec 17, 2024Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1.CVE-2024-55864 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the administrative page with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp mywpcustomize.com
Dec 6, 2024Futurio Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through <= 2.0.14.
Product
Futurio Extra
Affected
up to 2.0.14
What to do
Affects up to 2.0.14. Update Futurio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 26, 2024Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient inpuCVE-2024-11202 · WordPress plugins & themes · reported by WordfenceMedium 6.1
Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 26, 2024Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14.CVE-2024-53278 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin user customizes the admin screen with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the admin screen.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record gqevu6bsiz.chicappa.jp jvn.jp
Nov 16, 2024Gallerio: Unrestricted Upload of File with Dangerous TypeCVE-2024-52400 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Subhasis Laha Gallerio gallerio allows Upload a Web Shell to a Web Server.This issue affects Gallerio: from n/a through <= 1.01.
Product
Gallerio
Affected
up to 1.01
What to do
Affects up to 1.01. Update Gallerio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024Futurio Extra: Information ExposureCVE-2024-10695 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.
Product
Futurio Extra
Affected
up to 2.0.13
What to do
Affects up to 2.0.13. Update Futurio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 5, 2024Seriously Simple Podcasting: Reflected Cross-Site ScriptingCVE-2024-9667 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Seriously Simple Podcasting
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2024Futurio Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50446 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra.This issue affects Futurio Extra: from n/a through <= 2.0.11.
Product
Futurio Extra
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Futurio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2024Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions.CVE-2024-8725 · WordPress plugins & themes · reported by WordfenceMedium 6.8
Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files to any directory within the WordPress root directory, which could lead to Stored Cross-Site Scripting. The Advanced File Manager Shortcodes plugin must be installed to exploit this vulnerability.
Fixed in
5.2.9
What to do
Update the plugin to 5.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2024Seriously Simple Stats: Reflected Cross-Site ScriptingCVE-2024-8738 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Seriously Simple Stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Seriously Simple Stats
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Seriously Simple Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2024Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1.CVE-2024-45625 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.
Fixed in
1.34.1
What to do
Update the plugin to 1.34.1 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Aug 1, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in various AJAX actionsCVE-2024-1747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
Product
WooCommerce Customers Manager
Fixed in
30.2
What to do
Update WooCommerce Customers Manager to 30.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2024Seriously Simple Podcasting: Does not sanitise and escape some of its settingsCVE-2024-3751 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Seriously Simple Podcasting
Fixed in
3.3.0
What to do
Update Seriously Simple Podcasting to 3.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2024A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0.CVE-2024-38345 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.1
A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 3, 2024A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4.CVE-2024-38344 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Jun 25, 2024WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and outpuCVE-2024-6307 · WordPress plugins & themes · reported by WordfenceMedium 6.4
WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Jun 21, 2024Serious Slider: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Cryout Creations Serious Slider allows Stored XSS.This issue affects Serious Slider: from n/a through 1.2.4.
Product
Serious Slider
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Serious Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Futurio Extra: Stored Cross-Site ScriptingCVE-2024-5646 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Futurio Extra
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Futurio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024Music Store - WordPress eCommerce versions prior to 1.1.14: SQL injectionCVE-2024-36082 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands. Information stored in the database may be obtained or altered by the attacker.
Product
Music Store - WordPress eCommerce versions prior to 1.1.14
Fixed in
1.1.14
What to do
Update Music Store - WordPress eCommerce versions prior to 1.1.14 to 1.1.14 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
May 27, 2024Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5.CVE-2024-35297 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.7
Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing the web site using the product.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
May 22, 2024Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6.CVE-2024-35162 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switch_themes" privilege may obtain arbitrary files on the server.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
May 21, 2024Sailthru Triggermail: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-4289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Sailthru Triggermail
Affected
up to 1.1
What to do
Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2024Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability.CVE-2024-32674 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.
Fixed in
1.1.32
What to do
Update the plugin to 1.1.32 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 3, 2024WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outpuCVE-2024-4439 · WordPress plugins & themes · reported by WordfenceHigh 7.2
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
May 3, 2024Gutenverse: Does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embedCVE-2024-3692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenverse
Fixed in
1.9.1
What to do
Update Gutenverse to 1.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Serious Slider: Cross-Site Request Forgery (CSRF)CVE-2024-33650 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cryout Creations Serious Slider.This issue affects Serious Slider: from n/a through 1.2.4.
Product
Serious Slider
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Serious Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WooCommerce Customers Manager: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-1743 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WooCommerce Customers Manager
Fixed in
29.8
What to do
Update WooCommerce Customers Manager to 29.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 23, 2024Forminator prior to 1.15.4 contains a cross-site scripting vulnerability.CVE-2024-31857 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser.
Fixed in
1.15.4
What to do
Update the plugin to 1.15.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 23, 2024Forminator prior to 1.29.3 contains a SQL injection vulnerability.CVE-2024-31077 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.2
Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) condition.
Fixed in
1.29.3
What to do
Update the plugin to 1.29.3 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 23, 2024Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability.CVE-2024-28890 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.3
Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.
Fixed in
1.29.0
What to do
Update the plugin to 1.29.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 10, 2024custom fields for labels: Ninja Forms prior to 3.8.1 contains a cross-site scriptingCVE-2024-29220 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
Product
custom fields for labels
Fixed in
3.8.1
What to do
Update custom fields for labels to 3.8.1 or newer.
Full record and what to do →NVD record jvn.jp ninjaforms.com
Apr 10, 2024submit processing: Ninja Forms prior to 3.8.1 contains a cross-site scriptingCVE-2024-26019 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
Product
submit processing
Fixed in
3.8.1
What to do
Update submit processing to 3.8.1 or newer.
Full record and what to do →NVD record jvn.jp ninjaforms.com
Apr 10, 2024Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31.CVE-2024-25572 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.
Fixed in
3.4.31
What to do
Update the plugin to 3.4.31 or newer.
Full record and what to do →NVD record jvn.jp ninjaforms.com
Apr 3, 2024Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when postingCVE-2023-35764 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.3
Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when posting.
Fixed in
3.6.4
What to do
Update the plugin to 3.6.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 3, 2024Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability.CVE-2023-34423 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product with the administrative privilege.
Fixed in
3.6.4
What to do
Update the plugin to 3.6.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Mar 28, 2024Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25599 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting.This issue affects Seriously Simple Podcasting: from n/a through <= 3.0.2.
Product
Seriously Simple Podcasting
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.