Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

230 results · page 2 of 5

Mar 23, 2026ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More: Sensitive Information ExposureCVE-2025-10731 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the allReminderSettings function. This makes it possible for unauthenticated attackers to obtain authentication tokens and subsequently bypass admin restrictions to access and export sensitive data including order details, names, emails, addresses, phone numbers, and user information.
Product
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More
Affected
up to 2.2.12
What to do
Affects up to 2.2.12. Update ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 23, 2026ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More: Arbitrary method callsCVE-2025-10679 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to arbitrary method calls in all versions up to, and including, 2.2.12. This is due to insufficient input validation in the bulkTenReviews function that allows user-controlled data to be passed directly to a variable function call mechanism. This makes it possible for unauthenticated attackers to call arbitrary PHP class methods that take no inputs or have default values, potentially leading to information disclosure or remote code execution depending on available methods and server configuration.
Product
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More
Affected
up to 2.2.12
What to do
Affects up to 2.2.12. Update ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 23, 2026ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More: Unauthorized access of dataCVE-2025-10736 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorized access of data due to improper authorization checks on the userAccessibility() function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to access protected REST API endpoints, extract and modify information related to users and plugin's configuration
Product
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More
Affected
up to 2.2.10
What to do
Affects up to 2.2.10. Update ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2026Rich Showcase for Google Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32360 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richplugins Rich Showcase for Google Reviews widget-google-reviews allows Stored XSS.This issue affects Rich Showcase for Google Reviews: from n/a through <= 6.9.4.3.
Product
Rich Showcase for Google Reviews
Affected
up to 6.9.4.3
What to do
Affects up to 6.9.4.3. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 27, 2026Authenticated Iframe Injection in Dato CMS Web Previews plugin.CVE-2026-3327 · Other software · DatoCMS · reported by 3ba556a3-57d7-4c5d-b460-9d6daa180ee1Medium 4.8
Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews < v1.0.31.
Product
Web Previews
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 26, 2026WooCommerce Photo Reviews: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-28132 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews allows Code Injection.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.4.4.
Product
WooCommerce Photo Reviews
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update WooCommerce Photo Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026WiserReview Product Reviews for WooCommerce: Missing AuthorizationCVE-2026-25318 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wisernotify team WiserReview Product Reviews for WooCommerce wiser-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserReview Product Reviews for WooCommerce: from n/a through <= 2.9.
Product
WiserReview Product Reviews for WooCommerce
Affected
up to 2.9
What to do
Affects up to 2.9. Update WiserReview Product Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Better Business Reviews: Missing AuthorizationCVE-2026-23804 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.
Product
Better Business Reviews
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Better Business Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026WP Customer Reviews: Reflected Cross-Site ScriptingCVE-2025-14452 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Customer Reviews
Affected
up to 3.7.5
What to do
Affects up to 3.7.5. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 12, 2026Customer Reviews for WooCommerce: Stored Cross-Site ScriptingCVE-2026-1316 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[].href' parameter in all versions up to, and including, 5.97.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers (if 'Enable for Guests' is enabled) to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Customer Reviews for WooCommerce
Affected
up to 5.97.0
What to do
Affects up to 5.97.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 23, 2026Ultimate Reviews: Authorization Bypass Through User-Controlled KeyCVE-2026-24634 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Reviews: from n/a through <= 3.2.16.
Product
Ultimate Reviews
Affected
up to 3.2.16
What to do
Affects up to 3.2.16. Update Ultimate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Ryviu – Product Reviews for WooCommerce: Missing AuthorizationCVE-2026-24562 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ryviu Ryviu – Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ryviu – Product Reviews for WooCommerce: from n/a through <= 3.1.26.
Product
Ryviu – Product Reviews for WooCommerce
Affected
up to 3.1.26
What to do
Affects up to 3.1.26. Update Ryviu – Product Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026ListingPro Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69051 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through < 2.9.11.
Product
ListingPro Reviews
What to do
Update ListingPro Reviews to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 9, 2026Nearby Now Reviews: Stored Cross-Site ScriptingCVE-2025-13853 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcode in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Nearby Now Reviews
Affected
up to 5.2
What to do
Affects up to 5.2. Update Nearby Now Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Customer Reviews for WooCommerce: Stored Cross-Site ScriptingCVE-2025-14891 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. While it is possible to invoke the AJAX action without authentication, the attacker would need to know a valid form ID, which requires them to place an order. This vulnerability can be exploited by unauthenticated attackers if guest checkout is enabled. However, the form ID still needs to be obtained through placing an order.
Product
Customer Reviews for WooCommerce
Affected
up to 5.93.1
What to do
Affects up to 5.93.1. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2026Better Business Reviews: Missing AuthorizationCVE-2025-69354 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.
Product
Better Business Reviews
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Better Business Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 17, 2025The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress is vulnerablCVE-2025-13880 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings functions in all versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to view and modify plugin's advanced settings.
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Reviews Sorted: Stored Cross-Site ScriptingCVE-2025-13969 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Reviews Sorted
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Reviews Sorted to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 10, 2025Widgets for Google Reviews: Stored Cross-Site ScriptingCVE-2025-9436 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Widgets for Google Reviews
Affected
up to 13.2.1
What to do
Affects up to 13.2.1. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2025Social Reviews & Recommendations: Stored Cross-Site ScriptingCVE-2025-12705 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Social Reviews & Recommendations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the 'trim_text' function in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.5.
Product
Social Reviews & Recommendations
Affected
up to 2.5
What to do
Affects up to 2.5. Update Social Reviews & Recommendations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Rich Shortcodes for Google Reviews: Stored Cross-Site ScriptingCVE-2025-12499 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Rich Shortcodes for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contents of a Google Review in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in version 6.6.2.
Product
Rich Shortcodes for Google Reviews
Affected
up to 6.8
What to do
Affects up to 6.8. Update Rich Shortcodes for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Widgets for Google Reviews: Stored Cross-Site ScriptingCVE-2025-12510 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place that is connected to the vulnerable site.
Product
Widgets for Google Reviews
Affected
up to 13.2.4
What to do
Affects up to 13.2.4. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2025WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets: Stored Cross-Site ScriptingCVE-2025-13007 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted they can post malicious content to a connected Google Business Profile or Facebook page.
Product
WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets
Affected
up to 3.20.3
What to do
Affects up to 3.20.3. Update WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2025Customer Reviews Collector for WooCommerce: Reflected Cross-Site ScriptingCVE-2025-12123 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Customer Reviews Collector for WooCommerce
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update Customer Reviews Collector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-62071 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.29.
Product
Social proof testimonials and reviews by Repuso
Affected
up to 5.29
What to do
Affects up to 5.29. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025JetReviews: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49921 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 3.0.0.
Product
JetReviews
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update JetReviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 12, 2025IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users dueCVE-2025-2139 · Other software · IBM · reported by psirt@us.ibm.comLow 3.5
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security.
Product
Engineering Requirements Management Doors Next
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Sep 27, 2025Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms: Cross-Site Request ForgeryCVE-2025-9899 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the feed_save function. This makes it possible for unauthenticated attackers to create or modify feed entries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms
Affected
up to 1.0
What to do
Affects up to 1.0. Update Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2025ShrinkTheWeb (STW) Website Previews: Cross-Site Request Forgery (CSRF)CVE-2025-58677 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in puravida1976 ShrinkTheWeb (STW) Website Previews shrinktheweb-website-preview-plugin allows Stored XSS.This issue affects ShrinkTheWeb (STW) Website Previews: from n/a through <= 2.8.5.
Product
ShrinkTheWeb (STW) Website Previews
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update ShrinkTheWeb (STW) Website Previews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025ListingPro Reviews: Missing AuthorizationCVE-2025-58667 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro Reviews: from n/a through < 2.9.11.
Product
ListingPro Reviews
What to do
Update ListingPro Reviews to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Trustpilot Reviews: Missing AuthorizationCVE-2025-57997 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Trustpilot Trustpilot Reviews trustpilot-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trustpilot Reviews: from n/a through <= 2.5.925.
Product
Trustpilot Reviews
Affected
up to 2.5.925
What to do
Affects up to 2.5.925. Update Trustpilot Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025WooCommerce Photo Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.3.13.
Product
WooCommerce Photo Reviews
Affected
up to 1.3.13
What to do
Affects up to 1.3.13. Update WooCommerce Photo Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Widget for Google Reviews: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53565 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Widget for Google Reviews business-reviews-wp allows PHP Local File Inclusion.This issue affects Widget for Google Reviews: from n/a through <= 1.0.15.
Product
Widget for Google Reviews
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Widget for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Embedder for Google Reviews: Missing AuthorizationCVE-2025-54730 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews embedder-for-google-reviews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embedder for Google Reviews: from n/a through <= 1.7.3.
Product
Embedder for Google Reviews
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Embedder for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 31, 2025Customer Reviews for WooCommerce: Stored Cross-Site ScriptingCVE-2025-5720 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and including, 5.80.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Customer Reviews for WooCommerce
Affected
up to 5.80.2
What to do
Affects up to 5.80.2. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2025A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered.CVE-2025-54295 · Other software · dj-extensions.com · reported by security@joomla.orgMedium 5.1
A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered.
Product
DJ-Reviews component for Joomla
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dj-extensions.com
Jul 16, 2025Affiliate Reviews: Stored Cross-Site ScriptingCVE-2025-5845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Affiliate Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘numColumns’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Affiliate Reviews
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Affiliate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 8, 2025Widget for Google Reviews: Directory TraversalCVE-2025-7327 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
Product
Widget for Google Reviews
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Widget for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 17, 2025Ultimate Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49266 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Reflected XSS.This issue affects Ultimate Reviews: from n/a through <= 3.2.14.
Product
Ultimate Reviews
Affected
up to 3.2.14
What to do
Affects up to 3.2.14. Update Ultimate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 28, 2025SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indCVE-2025-5257 · Other software · Mautic · reported by security@mautic.orgMedium 6.5
SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information. Unauthorized Access to Unpublished Page Previews: The page preview functionality for unpublished content, accessible via predictable URLs (e.g., /page/preview/1, /page/preview/2), lacked proper authorization checks. This allowed any unauthenticated user to view content that was not yet intended for public release, and allowed search engines to index these private preview URLs, making the content publicly discoverable. MitigationMautic has patched this vulnerability by enforcing proper permission checks on preview pages. Users should upgrade to the patched version of Mautic or later.
Product
Mautic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 19, 2025JetReviews: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39396 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 2.3.6.
Product
JetReviews
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update JetReviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Review Wave – Google Places Reviews: Cross-Site Request Forgery (CSRF)CVE-2025-39442 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in MessageMetric Review Wave – Google Places Reviews review-wave-google-places-reviews allows Stored XSS.This issue affects Review Wave – Google Places Reviews: from n/a through <= 1.4.7.
Product
Review Wave – Google Places Reviews
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Review Wave – Google Places Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 2, 2025Shopper Approved Reviews: Unauthorized modification of data that can lead to privilege escalationCVE-2025-3063 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Shopper Approved Reviews
Affected
2.0 to 2.1
What to do
Affects 2.0 to 2.1. Update Shopper Approved Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-31886 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.21.
Product
Social proof testimonials and reviews by Repuso
Affected
up to 5.21
What to do
Affects up to 5.21. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Trust.Reviews: Missing AuthorizationCVE-2025-30883 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trust.Reviews: from n/a through <= 2.3.
Product
Trust.Reviews
Affected
up to 2.3
What to do
Affects up to 2.3. Update Trust.Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025TWB Woocommerce Reviews: Cross-Site Request Forgery (CSRF)CVE-2025-30801 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Abu Bakar TWB Woocommerce Reviews twb-woocommerce-reviews allows Cross Site Request Forgery.This issue affects TWB Woocommerce Reviews: from n/a through <= 1.7.7.
Product
TWB Woocommerce Reviews
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update TWB Woocommerce Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2025Site Reviews: Does not properly sanitise and escape some of its Review fieldsCVE-2025-1232 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks
Product
Site Reviews
Fixed in
7.2.5
What to do
Update Site Reviews to 7.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Mar 3, 2025WP Ultimate Reviews FREE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23739 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtibbles WP Ultimate Reviews FREE wp-ultimate-reviews-free allows Reflected XSS.This issue affects WP Ultimate Reviews FREE: from n/a through <= 1.0.2.
Product
WP Ultimate Reviews FREE
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Ultimate Reviews FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025ReviewsTap: Cross-Site Request Forgery (CSRF)CVE-2025-24561 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in awcode ReviewsTap reviewstap allows Stored XSS.This issue affects ReviewsTap: from n/a through <= 1.1.2.
Product
ReviewsTap
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update ReviewsTap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 18, 2025Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings: Stored Cross-Site ScriptingCVE-2024-13392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_reviews' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.