Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
88 results · page 2 of 2
Jul 30, 2026WP Real IP-based Access Control: Does not perform any capability or nonce checks before storing one of its option valuesCVE-2026-14592 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page.
- Product
- WP Real IP-based Access Control
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update WP Real IP-based Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 21, 2026Free Builder for Elementor: Does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboardCVE-2026-11767 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.
- Product
- Free Builder for Elementor
- Fixed in
- 1.6.7
- What to do
- Update Free Builder for Elementor to 1.6.7 or newer.
Jul 20, 2026Kirki: Does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sendsCVE-2026-12724 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
- Product
- Kirki
- Fixed in
- 6.0.12
- What to do
- Update Kirki to 6.0.12 or newer.
Jun 22, 2026Pie Register: Does not use sufficiently random valuesCVE-2026-10530 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.
- Product
- Pie Register
- Fixed in
- 3.8.4.10
- What to do
- Update Pie Register to 3.8.4.10 or newer.
Feb 19, 2026Simple Membership: Improper Handling of Missing ValuesCVE-2026-1461 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.
- Product
- Simple Membership
- Affected
- up to 4.7.0
- What to do
- Affects up to 4.7.0. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 15, 2025IP Based Login: Does not sanitise valuesCVE-2024-12800 · WordPress plugins & themes · reported by WPScanMedium 4.8
The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- IP Based Login
- Fixed in
- 2.4.1
- What to do
- Update IP Based Login to 2.4.1 or newer.
Jun 20, 2024The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values fCVE-2024-4565 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
- Product
- Advanced Custom Fields (ACF)
- Fixed in
- 6.3
- What to do
- Update Advanced Custom Fields (ACF) to 6.3 or newer.
Jan 16, 2024WPGraphQL WooCommerce: Does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQLCVE-2022-1563 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL.
- Product
- WPGraphQL WooCommerce
- Fixed in
- 0.12.4
- What to do
- Update WPGraphQL WooCommerce to 0.12.4 or newer.
Jan 8, 2024Duplicator: Does not properly escape valuesCVE-2018-25095 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
- Product
- Duplicator
- Fixed in
- 1.3.0
- What to do
- Update Duplicator to 1.3.0 or newer.
Dec 18, 2023Product Catalog Mode For WooCommerce: Does not properly authorize settings updates or escape settings valuesCVE-2023-5348 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
- Product
- Product Catalog Mode For WooCommerce
- Fixed in
- 5.0.3
- What to do
- Update Product Catalog Mode For WooCommerce to 5.0.3 or newer.
Sep 25, 2023All in One B2B for WooCommerce: Does not properly check nonce values in several actionsCVE-2023-3547 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks.
- Product
- All in One B2B for WooCommerce
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update All in One B2B for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 31, 2023Forminator: Does not properly escape values that are being reflected inside form fields that use pre-populated query parametersCVE-2023-3134 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
- Product
- Forminator
- Fixed in
- 1.24.4
- What to do
- Update Forminator to 1.24.4 or newer.
Jul 31, 2023Twittee Text Tweet: Does not properly escape POST valuesCVE-2023-0602 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.
- Product
- Twittee Text Tweet
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Twittee Text Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2023Contact Form Email: Does not escape submitted values before displaying them in the HTMLCVE-2023-2718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.
- Product
- Contact Form Email
- Fixed in
- 1.3.38
- What to do
- Update Contact Form Email to 1.3.38 or newer.
May 15, 2023Active Directory Integration / LDAP Integration: Does not have proper authorization or nonce values for some POST requestsCVE-2023-0812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.
- Product
- Active Directory Integration / LDAP Integration
- Fixed in
- 4.1.1
- What to do
- Update Active Directory Integration / LDAP Integration to 4.1.1 or newer.
Apr 17, 2023Gallery by BestWebSoft: Does not properly escape values used in SQL queriesCVE-2023-0765 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable.
- Product
- Gallery by BestWebSoft
- Fixed in
- 4.7.0
- What to do
- Update Gallery by BestWebSoft to 4.7.0 or newer.
Feb 21, 2022Advanced Database Cleaner: Does not sanitise and escape $_GET keys and values before outputting them back in attributesCVE-2021-24921 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Advanced Database Cleaner
- Fixed in
- 3.0.4
- What to do
- Update Advanced Database Cleaner to 3.0.4 or newer.
Dec 27, 2021Contact Form & Lead Form Elementor Builder: Does not sanitise and escape some lead valuesCVE-2021-24967 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
- Product
- Contact Form & Lead Form Elementor Builder
- Fixed in
- 1.6.4
- What to do
- Update Contact Form & Lead Form Elementor Builder to 1.6.4 or newer.
Dec 13, 2021Get Custom Field Values: Allows users with a roleCVE-2021-24872 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.
- Product
- Get Custom Field Values
- Fixed in
- 4.0
- What to do
- Update Get Custom Field Values to 4.0 or newer.
Dec 13, 2021Get Custom Field Values: Does not escape custom fields before outputting them in the pageCVE-2021-24871 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Get Custom Field Values
- Fixed in
- 4.0.1
- What to do
- Update Get Custom Field Values to 4.0.1 or newer.
Nov 29, 2021About Author Box: Does not sanitise and escape the Social Profiles field values before outputting them in attributesCVE-2021-24745 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- About Author Box
- Fixed in
- 1.0.2
- What to do
- Update About Author Box to 1.0.2 or newer.
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.3
- What to do
- Update Modern Events Calendar Lite to 5.22.3 or newer.
Oct 11, 2021Appointment Hour Booking: Does not properly sanitize values usedCVE-2021-24712 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.17
- What to do
- Update Appointment Hour Booking to 1.3.17 or newer.
Sep 13, 2021WordPress Advanced Ticket System, Elite Support Helpdesk: Does not sanitize or escape form values before saving to the database orCVE-2021-24623 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordPress Advanced Ticket System, Elite Support Helpdesk
- Fixed in
- 1.0.64
- What to do
- Update WordPress Advanced Ticket System, Elite Support Helpdesk to 1.0.64 or newer.
Aug 9, 2021Side Menu Lite – add sticky fixed buttons: Does not properly sanitize input values from the browserCVE-2021-24521 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
- Product
- Side Menu Lite – add sticky fixed buttons
- Fixed in
- 2.2.1
- What to do
- Update Side Menu Lite – add sticky fixed buttons to 2.2.1 or newer.
Oct 10, 2019The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.CVE-2015-9465 · WordPress plugins & themes · reported by MITREHigh 8.8
The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.
- Product
- yet-another-stars-rating
- Fixed in
- 0.9.1
- What to do
- Update yet-another-stars-rating to 0.9.1 or newer.
May 20, 2019The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.CVE-2019-12240 · WordPress plugins & themes · reported by MITRECritical 9.8
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.
- Affected
- 0.4 to 0.4
- What to do
- Affects 0.4 to 0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 5, 2019The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values.CVE-2019-7412 · WordPress plugins & themes · reported by MITRECritical 9.8
The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values.
- Product
- PS PHPCaptcha WP
- Fixed in
- 1.2.0
- What to do
- Update PS PHPCaptcha WP to 1.2.0 or newer.
Full record and what to do →NVD recordmetamorfosec.comwordpress.org
Nov 14, 2017installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-contCVE-2017-16815 · WordPress plugins & themes · reported by MITREMedium 6.1
installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-content/plugins/duplicator/installer/build/view.step4.php) and "logging" (wp-content/plugins/duplicator/installer/build/view.step2.php) are not filtered correctly.
- Product
- installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup)
- Fixed in
- 1.2.30
- What to do
- Update installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) to 1.2.30 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsnapcreek.com
Oct 23, 2017The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.CVE-2017-15812 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
- Product
- Easy Appointments
- Fixed in
- 1.12.0
- What to do
- Update Easy Appointments to 1.12.0 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 19, 2017WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging accessCVE-2012-6707 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org
Oct 2, 2017WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it CVE-2017-14990 · WordPress plugins & themes · reported by MITREMedium 6.5
WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecuritytracker.comcore.trac.wordpress.org
Sep 23, 2017Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility oCVE-2017-14723 · WordPress plugins & themes · reported by MITRECritical 9.8
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 18, 2017In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.CVE-2017-9062 · WordPress plugins & themes · reported by MITREHigh 8.6
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
- Fixed in
- 4.7.5
- What to do
- Update the plugin to 4.7.5 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
May 14, 2016The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST reqCVE-2016-1209 · WordPress plugins & themes · reported by vultures@jpcert.or.jpCritical 9.8
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
- Product
- Ninja Forms
- Fixed in
- 2.9.42.1
- What to do
- Update Ninja Forms to 2.9.42.1 or newer.
Aug 18, 2014wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it CVE-2014-5205 · WordPress plugins & themes · reported by MITREMedium 6.8
wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.
- Fixed in
- 3.9.2
- What to do
- Update the plugin to 3.9.2 or newer.
Full record and what to do →NVD recordopenwall.comdebian.org
Oct 20, 2008The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.CVE-2008-4616 · WordPress plugins & themes · reported by MITREMedium 5
The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Nov 19, 2007Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MDCVE-2007-6013 · WordPress plugins & themes · reported by MITRECritical 9.8
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.grok.org.ukosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.