Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

304 results · page 2 of 7

Nov 5, 2025B Carousel Block – Responsive Image and Content Carousel: Server-Side Request ForgeryCVE-2025-12388 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.1.5. This is due to the plugin not validating user-supplied URLs before passing them to the wp_remote_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
B Carousel Block – Responsive Image and Content Carousel
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update B Carousel Block – Responsive Image and Content Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025Bootstrap Multi-language Responsive Portfolio: Stored Cross-Site ScriptingCVE-2025-11753 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Bootstrap Multi-language Responsive Portfolio
Affected
up to 1.0
What to do
Affects up to 1.0. Update Bootstrap Multi-language Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Oct 26, 2025Photospace Responsive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62899 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in THRIVE - Web Design Gold Coast Photospace Responsive photospace-responsive allows Stored XSS.This issue affects Photospace Responsive: from n/a through <= 2.2.0.
Product
Photospace Responsive
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Photospace Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2025Multi Item Responsive Slider: Cross-Site Request ForgeryCVE-2025-11992 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'mioptions.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Multi Item Responsive Slider
Affected
up to 1.0
What to do
Affects up to 1.0. Update Multi Item Responsive Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Oct 22, 2025Responsive Progress Bar: Stored Cross-Site ScriptingCVE-2025-11883 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Progress Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rprogress shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Progress Bar
What to do
Update Responsive Progress Bar to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025WP Responsive Meet The Team: Stored Cross-Site ScriptingCVE-2025-11818 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprm_team' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Responsive Meet The Team
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Responsive Meet The Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025Responsive iframe GoogleMap: Stored Cross-Site ScriptingCVE-2025-11813 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive iframe GoogleMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive_map' shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on the 'width' and 'height' attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive iframe GoogleMap
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Responsive iframe GoogleMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 6, 2025Responsive Lightbox & Gallery: Does not properly handle HTML tag attributes modificationsCVE-2025-9710 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.
Product
Responsive Lightbox & Gallery
Fixed in
2.5.3
What to do
Update Responsive Lightbox & Gallery to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2025Side Slide Responsive Menu: Cross-Site Request ForgeryCVE-2025-9880 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Side Slide Responsive Menu
Affected
up to 1.0
What to do
Affects up to 1.0. Update Side Slide Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025Responsive Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-8215 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Addons for Elementor
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 10, 2025Responsive Filterable Portfolio: Arbitrary file uploadsCVE-2025-10049 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelection_image field in all versions up to, and including, 1.0.24. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Responsive Filterable Portfolio
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update Responsive Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 5, 2025eDS Responsive Menu: Deserialization of Untrusted DataCVE-2025-58839 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Object Injection.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
Product
eDS Responsive Menu
Affected
up to 1.2
What to do
Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Responsive Mobile-Friendly Tooltip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48316 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip responsive-mobile-friendly-tooltip allows Stored XSS.This issue affects Responsive Mobile-Friendly Tooltip: from n/a through <= 1.6.6.
Product
Responsive Mobile-Friendly Tooltip
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Responsive Mobile-Friendly Tooltip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Responsive HTML5 Audio Player PRO With Playlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54056 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows Reflected XSS.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through <= 3.5.8.
Product
Responsive HTML5 Audio Player PRO With Playlist
Affected
up to 3.5.8
What to do
Affects up to 3.5.8. Update Responsive HTML5 Audio Player PRO With Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Responsive Posts Carousel Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52728 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.0.
Product
Responsive Posts Carousel Pro
Affected
up to 15.0
What to do
Affects up to 15.0. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 11, 2025Simple Responsive Slider: Stored Cross-Site ScriptingCVE-2025-8690 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Responsive Slider
Affected
up to 2.0
What to do
Affects up to 2.0. Update Simple Responsive Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Jul 24, 2025Responsive Thumbnail Slider: Arbitrary file uploadsCVE-2015-10144 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.
Product
Responsive Thumbnail Slider
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Responsive Thumbnail Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cxsecurity.com raw.githubusercontent.com
Jul 18, 2025Useful Tab Block – Responsive & AMP-Compatible: Stored Cross-Site ScriptingCVE-2025-5754 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Useful Tab Block – Responsive & AMP-Compatible
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Useful Tab Block – Responsive & AMP-Compatible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 16, 2025Multi-language Responsive Contact Form: Missing AuthorizationCVE-2025-29000 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in August Infotech Multi-language Responsive Contact Form responsive-contact-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Multi-language Responsive Contact Form: from n/a through <= 2.8.
Product
Multi-language Responsive Contact Form
Affected
up to 2.8
What to do
Affects up to 2.8. Update Multi-language Responsive Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Responsive Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Stored XSS.This issue affects Responsive Addons for Elementor: from n/a through <= 1.7.3.
Product
Responsive Addons for Elementor
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Stored Cross-Site ScriptingCVE-2025-6068 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
Affected
up to 2.4.31
What to do
Affects up to 2.4.31. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2025The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to CVE-2025-6934 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53202 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows DOM-Based XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.6.
Product
Responsive Blocks
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Responsive Lightbox & Gallery: Use the Swipebox libraryCVE-2025-5093 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive Lightbox & Gallery
Fixed in
2.5.2
What to do
Update Responsive Lightbox & Gallery to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 25, 2025Responsive Food and Drink Menu: Stored Cross-Site ScriptingCVE-2025-6378 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Food and Drink Menu
Affected
up to 2.3
What to do
Affects up to 2.3. Update Responsive Food and Drink Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 25, 2025Owl carousel responsive: Time-based SQL InjectionCVE-2025-5590 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Owl carousel responsive plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Owl carousel responsive
Affected
up to 1.9
What to do
Affects up to 1.9. Update Owl carousel responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 20, 2025eDS Responsive Menu: Missing AuthorizationCVE-2025-49971 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
Product
eDS Responsive Menu
Affected
up to 1.2
What to do
Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Stored XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.5.
Product
Responsive Blocks
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Responsive Plus: Cross-Site Request Forgery (CSRF)CVE-2025-49856 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsive Plus: from n/a through <= 3.2.2.
Product
Responsive Plus
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Responsive Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2025-5291 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide shortcodes in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.10.8
What to do
Affects up to 3.10.8. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2025ShiftNav – Responsive Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49243 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-responsive-mobile-menu allows Stored XSS.This issue affects ShiftNav – Responsive Mobile Menu: from n/a through <= 1.8.
Product
ShiftNav – Responsive Mobile Menu
Affected
up to 1.8
What to do
Affects up to 1.8. Update ShiftNav – Responsive Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Recent Posts Slider Responsive: Cross-Site Request Forgery (CSRF)CVE-2025-28966 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affects Recent Posts Slider Responsive: from n/a through <= 1.0.1.
Product
Recent Posts Slider Responsive
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Recent Posts Slider Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Responsive Flipbooks: Missing AuthorizationCVE-2025-24776 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codelobster Responsive Flipbooks responsive-flipbooks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Flipbooks: from n/a through <= 1.0.
Product
Responsive Flipbooks
Affected
up to 1.0
What to do
Affects up to 1.0. Update Responsive Flipbooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Responsive Plus: Missing AuthorizationCVE-2025-48335 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Plus: from n/a through <= 3.2.0.
Product
Responsive Plus
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Responsive Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Enzio - Responsive Business: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31912 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Enzio - Responsive Business WordPress Theme enzio allows PHP Local File Inclusion.This issue affects Enzio - Responsive Business WordPress Theme: from n/a through < 1.2.6.
Product
Enzio - Responsive Business
What to do
Update Enzio - Responsive Business to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025Kiamo - Responsive Business Service: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31633 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kiamo - Responsive Business Service WordPress Theme allows PHP Local File Inclusion. This issue affects Kiamo - Responsive Business Service WordPress Theme: from n/a through 1.3.3.
Product
Kiamo - Responsive Business Service
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Kiamo - Responsive Business Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 21, 2025Madara – Responsive and modern WordPress theme for manga sites: Local File InclusionCVE-2025-4524 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Madara – Responsive and modern WordPress theme for manga sites
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Madara – Responsive and modern WordPress theme for manga sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mangabooth.com wordfence.com
May 16, 2025Responsive HTML5 Audio Player PRO With Playlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32287 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows SQL Injection.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through <= 3.5.7.
Product
Responsive HTML5 Audio Player PRO With Playlist
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Responsive HTML5 Audio Player PRO With Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Multimedia Responsive Carousel with Image Video Audio Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31928 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Multimedia Responsive Carousel with Image Video Audio Support multimedia-carousel allows SQL Injection.This issue affects Multimedia Responsive Carousel with Image Video Audio Support: from n/a through <= 2.6.0.
Product
Multimedia Responsive Carousel with Image Video Audio Support
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Multimedia Responsive Carousel with Image Video Audio Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Magic Responsive Slider and Carousel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31640 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic-carousel allows SQL Injection.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through < 1.6.
Product
Magic Responsive Slider and Carousel
What to do
Update Magic Responsive Slider and Carousel to the newest version.
Full record and what to do →NVD record patchstack.com
May 15, 2025Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-4091 · WordPress plugins & themes · reported by WPScanLow 3.5
The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Responsive Gallery Grid
Fixed in
2.3.15
What to do
Update Responsive Gallery Grid to 2.3.15 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Responsive Contact Form Builder & Lead Generation: Does not sanitise and escape some of its settingsCVE-2024-10475 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Responsive Contact Form Builder & Lead Generation
Fixed in
1.9.8
What to do
Update Responsive Contact Form Builder & Lead Generation to 1.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Responsive Lightbox & Gallery: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3742 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive Lightbox & Gallery
Fixed in
2.5.1
What to do
Update Responsive Lightbox & Gallery to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com
May 7, 2025Responsive Plus: Missing AuthorizationCVE-2025-47486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Responsive Plus: from n/a through <= 3.1.9.
Product
Responsive Plus
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update Responsive Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 30, 2025Simple Sitemap – Create a Responsive HTML Sitemap: Missing AuthorizationCVE-2025-39413 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through <= 3.6.0.
Product
Simple Sitemap – Create a Responsive HTML Sitemap
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Simple Sitemap – Create a Responsive HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Responsive Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Stored XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.2.
Product
Responsive Blocks
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Stored Cross-Site ScriptingCVE-2025-2225 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rael_title_tag' parameter in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 1.6.9.
Product
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 4, 2025Freetobook Responsive Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32273 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in freetobook Freetobook Responsive Widget freetobook-responsive-widget allows Cross Site Request Forgery.This issue affects Freetobook Responsive Widget: from n/a through <= 1.1.
Product
Freetobook Responsive Widget
Affected
up to 1.1
What to do
Affects up to 1.1. Update Freetobook Responsive Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Lightweight and Responsive Youtube Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31744 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpszaki Lightweight and Responsive Youtube Embed lightweight-and-responsive-youtube-embed allows Stored XSS.This issue affects Lightweight and Responsive Youtube Embed: from n/a through <= 1.0.0.
Product
Lightweight and Responsive Youtube Embed
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Lightweight and Responsive Youtube Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Lightweight and Responsive Youtube Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31743 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpszaki Lightweight and Responsive Youtube Embed lightweight-and-responsive-youtube-embed allows Stored XSS.This issue affects Lightweight and Responsive Youtube Embed: from n/a through <= 1.0.0.
Product
Lightweight and Responsive Youtube Embed
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Lightweight and Responsive Youtube Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.