Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
80 results · page 2 of 2
Dec 31, 2025Custom Post Status: Cross-Site Request Forgery (CSRF)CVE-2025-68885 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in page-carbajal Custom Post Status custom-post-status allows Stored XSS.This issue affects Custom Post Status: from n/a through <= 1.1.0.
- Product
- Custom Post Status
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Custom Post Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Unauthorized access of dataCVE-2025-13741 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getAuthors function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve emails for all users with edit_posts capability.
- Product
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
- Affected
- up to 4.9.2
- What to do
- Affects up to 4.9.2. Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 21, 2025Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Unauthorized modification of dataCVE-2025-13149 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint.
- Product
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Oct 22, 2025Email Attachment by Order Status & Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49957 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Email Attachment by Order Status & Products email-attachment-by-order-status-products allows Reflected XSS.This issue affects Email Attachment by Order Status & Products: from n/a through <= 1.0.1.
- Product
- Email Attachment by Order Status & Products
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Email Attachment by Order Status & Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Scheduled & Automatic Order Status Controller for WooCommerce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30781 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order Status Controller for WooCommerce: from n/a through <= 3.7.1.
- Product
- Scheduled & Automatic Order Status Controller for WooCommerce
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Scheduled & Automatic Order Status Controller for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Delete Comments By Status: Relative Path TraversalCVE-2025-25130 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Relative Path Traversal vulnerability in Shah Alom Delete Comments By Status delete-comments-by-status allows Path Traversal.This issue affects Delete Comments By Status: from n/a through <= 2.1.1.
- Product
- Delete Comments By Status
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Delete Comments By Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Status Updater: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25124 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devu Status Updater fb-status-updater allows Reflected XSS.This issue affects Status Updater: from n/a through <= 1.9.2.
- Product
- Status Updater
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Status Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Extended Post Status: Missing AuthorizationCVE-2023-32094 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Felix Welberg Extended Post Status allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extended Post Status: from n/a through 1.0.19.
- Product
- Extended Post Status
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Extended Post Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 4, 2024Additional Custom Order Status for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11814 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Additional Custom Order Status for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wfwp_wcos_delete_finished, wfwp_wcos_delete_fallback_finished, wfwp_wcos_delete_fallback_orders_updated, and wfwp_wcos_delete_fallback_status parameters in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Additional Custom Order Status for WooCommerce
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Additional Custom Order Status for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 21, 2024StreamWeasels Online Status Bar: Stored Cross-Site ScriptingCVE-2024-11438 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The StreamWeasels Online Status Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sw-status-bar' shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- StreamWeasels Online Status Bar
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update StreamWeasels Online Status Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 29, 2024Post Status Notifier Lite and Premium: Reflected Cross-Site ScriptingCVE-2024-10048 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Post Status Notifier Lite and Premium plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.11.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Post Status Notifier Lite and Premium
- Affected
- up to 1.11.6
- What to do
- Affects up to 1.11.6. Update Post Status Notifier Lite and Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2024Ultimate 410 Gone Status Code: Stored Cross-Site ScriptingCVE-2024-3677 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate 410 Gone Status Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 410 entries in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ultimate 410 Gone Status Code
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Ultimate 410 Gone Status Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 17, 2024Custom Order Statuses for WooCommerce: Missing AuthorizationCVE-2024-32524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.
- Product
- Custom Order Statuses for WooCommerce
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Custom Order Statuses for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 4, 2024Events Tickets Plus: Does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of statusCVE-2024-1319 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
- Product
- Events Tickets Plus
- Fixed in
- 5.9.1
- What to do
- Update Events Tickets Plus to 5.9.1 or newer.
Feb 28, 2024Custom Order Statuses for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-25930 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.
- Product
- Custom Order Statuses for WooCommerce
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Custom Order Statuses for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versCVE-2023-47766 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versions.
- Fixed in
- 1.11.1
- What to do
- Update the plugin to 1.11.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 6, 2023The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticCVE-2021-4347 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
May 15, 2023WooCommerce Order Status Change Notifier: Does not have authorisation and CSRFCVE-2023-2179 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
- Product
- WooCommerce Order Status Change Notifier
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WooCommerce Order Status Change Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Post Status Notifier Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin.
- Product
- Post Status Notifier Lite
- Fixed in
- 1.10.1
- What to do
- Update Post Status Notifier Lite to 1.10.1 or newer.
Jul 21, 2022Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.CVE-2022-32289 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jan 24, 2022WP User Frontend: Does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboardCVE-2021-25076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
- Product
- WP User Frontend
- Fixed in
- 3.5.26
- What to do
- Update WP User Frontend to 3.5.26 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Dec 21, 2021Contact Form, Drag and Drop Form Builder for: Does not escape the status parameter before outputting it back in an attributeCVE-2021-24907 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- Contact Form, Drag and Drop Form Builder for
- Fixed in
- 1.8.0
- What to do
- Update Contact Form, Drag and Drop Form Builder for to 1.8.0 or newer.
Dec 21, 2021The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenCVE-2021-24846 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber
- Product
- Ni WooCommerce Custom Order Status
- Fixed in
- 1.9.7
- What to do
- Update Ni WooCommerce Custom Order Status to 1.9.7 or newer.
Dec 13, 2021Improved Include Page: Allows passing shortcode attributes with post_type & post_statusCVE-2021-24845 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.
- Product
- Improved Include Page
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Improved Include Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021Game Server Status: Does not validate or escape the server_id parameter before using it in SQL statementCVE-2021-24662 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authenticated SQL Injection in an admin page
- Product
- Game Server Status
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Game Server Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2021pspin_duplicate_post_save_as_new_post function of the Project Status: Does not sanitiseCVE-2021-24558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue
- Product
- pspin_duplicate_post_save_as_new_post function of the Project Status
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update pspin_duplicate_post_save_as_new_post function of the Project Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Dec 27, 2020The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_staCVE-2020-29156 · WordPress plugins & themes · reported by MITREMedium 5.3
The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.
- Product
- WooCommerce
- Fixed in
- 4.7.0
- What to do
- Update WooCommerce to 4.7.0 or newer.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Aug 31, 2020The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.CVE-2020-25033 · WordPress plugins & themes · reported by MITREMedium 6.1
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
- Affected
- 1.3.1 to 1.3.1
- What to do
- Affects 1.3.1 to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgzeroaptitude.com
Jul 3, 2019A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQCVE-2019-12570 · WordPress plugins & themes · reported by MITREHigh 8.8
A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters.
- Product
- Xpert Solution "Server Status by Hostname/IP
- Affected
- 4.6 to 4.6
- What to do
- Affects 4.6 to 4.6. Update Xpert Solution "Server Status by Hostname/IP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwpvulndb.com
Apr 24, 2017There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.CVE-2017-8099 · WordPress plugins & themes · reported by MITREHigh 8.1
There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.
- Product
- There is CSRF in the WHIZZ
- Fixed in
- 1.1.1
- What to do
- Update There is CSRF in the WHIZZ to 1.1.1 or newer.
Full record and what to do →NVD recordseclists.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.