Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,714entries in the database

290 results · page 2 of 6

Jan 14, 2026Electric Studio Download Counter: Stored Cross-Site ScriptingCVE-2026-0741 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Electric Studio Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Electric Studio Download Counter
Affected
up to 2.4
What to do
Affects up to 2.4. Update Electric Studio Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026Responsive Accordion Slider: Unauthorized modification of dataCVE-2026-0635 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordion_silder_save_images' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify any slider's image metadata including titles, descriptions, alt text, and links.
Product
Responsive Accordion Slider
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Responsive Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2026Contentstudio: Unrestricted Upload of File with Dangerous TypeCVE-2025-67910 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudio: from n/a through <= 1.3.7.
Product
Contentstudio
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Contentstudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Accordion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69350 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.This issue affects Accordion: from n/a through <= 3.0.3.
Product
Accordion
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Accordion Slider Gallery: Missing AuthorizationCVE-2025-62130 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdiscover Accordion Slider Gallery accordion-slider-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion Slider Gallery: from n/a through <= 2.7.
Product
Accordion Slider Gallery
Affected
up to 2.7
What to do
Affects up to 2.7. Update Accordion Slider Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Audiomack: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49357 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in audiomack Audiomack audiomack allows Stored XSS.This issue affects Audiomack: from n/a through <= 1.4.8.
Product
Audiomack
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Audiomack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 19, 2025HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player: Server-Side Request ForgeryCVE-2025-13999 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions from 2.4.0 up to, and including, 2.5.1 via the getIcyMetadata() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2025Rare Radio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60051 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Rare Radio rareradio allows PHP Local File Inclusion.This issue affects Rare Radio: from n/a through <= 1.0.15.1.
Product
Rare Radio
Affected
up to 1.0.15.1
What to do
Affects up to 1.0.15.1. Update Rare Radio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Palladio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49368 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Palladio palladio allows PHP Local File Inclusion.This issue affects Palladio: from n/a through <= 1.1.10.
Product
Palladio
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Palladio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Read More & Accordion: Missing AuthorizationCVE-2025-64247 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Read More & Accordion: from n/a through <= 3.5.5.1.
Product
Read More & Accordion
Affected
up to 3.5.5.1
What to do
Affects up to 3.5.5.1. Update Read More & Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Accessibility by AudioEye: Missing AuthorizationCVE-2025-64246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through <= 1.0.49.
Product
Accessibility by AudioEye
Affected
up to 1.0.49
What to do
Affects up to 1.0.49. Update Accessibility by AudioEye to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 14, 2025Lightweight Accordion: Stored Cross-Site ScriptingCVE-2025-13740 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `lightweight-accordion` shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lightweight Accordion
Affected
up to 1.5.20
What to do
Affects up to 1.5.20. Update Lightweight Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2025Accordion Slider PRO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67518 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Accordion Slider PRO accordion_slider_pro allows Blind SQL Injection.This issue affects Accordion Slider PRO: from n/a through <= 1.2.
Product
Accordion Slider PRO
Affected
up to 1.2
What to do
Affects up to 1.2. Update Accordion Slider PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Trinity Audio: Missing AuthorizationCVE-2025-67466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.23.3.
Product
Trinity Audio
Affected
up to 5.23.3
What to do
Affects up to 5.23.3. Update Trinity Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 5, 2025ContentStudio: Cross-Site Request ForgeryCVE-2025-13144 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ContentStudio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.7. This is due to missing or insufficient nonce validation on the add_cstu_settings function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ContentStudio
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025ContentStudio: Arbitrary file uploadsCVE-2025-12181 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2025-67910 is likely a duplicate of this.
Product
ContentStudio
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 21, 2025Accordion Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66092 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bqworks Accordion Slider accordion-slider allows Stored XSS.This issue affects Accordion Slider: from n/a through <= 1.9.13.
Product
Accordion Slider
Affected
up to 1.9.13
What to do
Affects up to 1.9.13. Update Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025WP AUDIO GALLERY: Arbitrary file deletionCVE-2025-13322 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.0. This is due to the `wpag_uploadaudio_callback()` AJAX handler not properly validating user-supplied file paths in the `audio_upload` parameter before passing them to `unlink()`. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when critical files like wp-config.php are deleted.
Product
WP AUDIO GALLERY
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP AUDIO GALLERY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025AudioTube: Stored Cross-Site ScriptingCVE-2025-11801 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AudioTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' shortcode attribute of the 'audiotube' shortcode in all versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AudioTube
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update AudioTube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Accordion: Missing AuthorizationCVE-2025-53421 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.
Product
Accordion
Affected
up to 2.3.14
What to do
Affects up to 2.3.14. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2025Woocommerce Category and Products Accordion Panel: Local File InclusionCVE-2025-11722 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Woocommerce Category and Products Accordion Panel plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordionpanel' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
Woocommerce Category and Products Accordion Panel
Affected
up to 1.0
What to do
Affects up to 1.0. Update Woocommerce Category and Products Accordion Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2025Trinity Audio – Text to Speech AI audio player to convert content into audio: Sensitive Information ExposureCVE-2025-9196 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data.
Product
Trinity Audio – Text to Speech AI audio player to convert content into audio
Affected
up to 5.21.0
What to do
Affects up to 5.21.0. Update Trinity Audio – Text to Speech AI audio player to convert content into audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 4, 2025Trinity Audio – Text to Speech AI audio player to convert content into audio: Reflected Cross-Site ScriptingCVE-2025-9952 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Trinity Audio – Text to Speech AI audio player to convert content into audio
Affected
up to 5.20.2
What to do
Affects up to 5.20.2. Update Trinity Audio – Text to Speech AI audio player to convert content into audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2025Trinity Audio – Text to Speech AI audio player to convert content into audio: Cross-Site Request ForgeryCVE-2025-9886 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.20.2. This is due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. This makes it possible for unauthenticated attackers to activate/deactivate posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Trinity Audio – Text to Speech AI audio player to convert content into audio
Affected
up to 5.20.2
What to do
Affects up to 5.20.2. Update Trinity Audio – Text to Speech AI audio player to convert content into audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2025Accordion: Missing AuthorizationCVE-2025-58678 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.15.
Product
Accordion
Affected
up to 2.3.15
What to do
Affects up to 2.3.15. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025AnyClip Luminous Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58271 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip Luminous Studio anyclip-media allows Stored XSS.This issue affects AnyClip Luminous Studio: from n/a through <= 1.3.3.
Product
AnyClip Luminous Studio
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update AnyClip Luminous Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025AnyClip Luminous Studio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57910 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip Luminous Studio anyclip-media allows Stored XSS.This issue affects AnyClip Luminous Studio: from n/a through <= 1.3.3.
Product
AnyClip Luminous Studio
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update AnyClip Luminous Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 12, 2025Embed Google Datastudio: Stored Cross-Site ScriptingCVE-2025-9877 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Google Datastudio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'egds' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Embed Google Datastudio
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Embed Google Datastudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 5, 2025LA-Studio Element Kit for Elementor: Stored Cross-Site ScriptingCVE-2025-8360 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets in all versions up to, and including, 1.5.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.5.5.1
What to do
Affects up to 1.5.5.1. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2025Smooth Accordion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58838 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zakir Smooth Accordion smooth-accordion allows Stored XSS.This issue affects Smooth Accordion: from n/a through <= 2.1.
Product
Smooth Accordion
Affected
up to 2.1
What to do
Affects up to 2.1. Update Smooth Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Responsive HTML5 Audio Player PRO With Playlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54056 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows Reflected XSS.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through <= 3.5.8.
Product
Responsive HTML5 Audio Player PRO With Playlist
Affected
up to 3.5.8
What to do
Affects up to 3.5.8. Update Responsive HTML5 Audio Player PRO With Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025HTML5 Radio Player - WPBakery Page Builder Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg_radio_player_addon_visual_composer allows Reflected XSS.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through <= 2.5.
Product
HTML5 Radio Player - WPBakery Page Builder Addon
Affected
up to 2.5
What to do
Affects up to 2.5. Update HTML5 Radio Player - WPBakery Page Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Radio Player Shoutcast & Icecast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53205 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Radio Player Shoutcast & Icecast lbg-audio4-html5-shoutcast allows Reflected XSS.This issue affects Radio Player Shoutcast & Icecast: from n/a through <= 4.4.7.
Product
Radio Player Shoutcast & Icecast
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update Radio Player Shoutcast & Icecast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Themify Audio Dock: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49392 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock themify-audio-dock allows Stored XSS.This issue affects Themify Audio Dock: from n/a through <= 2.0.5.
Product
Themify Audio Dock
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Themify Audio Dock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Apollo - Sticky Full Width HTML5 Audio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48168 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through <= 3.4.
Product
Apollo - Sticky Full Width HTML5 Audio Player
Affected
up to 3.4
What to do
Affects up to 3.4. Update Apollo - Sticky Full Width HTML5 Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48163 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support lbg-audio8-html5-radio-ads allows Reflected XSS.This issue affects SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support: from n/a through <= 3.5.4.
Product
SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 24, 2025Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to inCVE-2025-8071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2025HTML5 Radio Player - WPBakery Page Builder Addon: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31070 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg-cleverbakery allows Path Traversal.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through <= 2.5.
Product
HTML5 Radio Player - WPBakery Page Builder Addon
Affected
up to 2.5
What to do
Affects up to 2.5. Update HTML5 Radio Player - WPBakery Page Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Radio Station: Cross-Site Request Forgery (CSRF)CVE-2025-53568 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station allows Cross Site Request Forgery.This issue affects Radio Station: from n/a through <= 2.5.12.
Product
Radio Station
Affected
up to 2.5.12
What to do
Affects up to 2.5.12. Update Radio Station to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Audio Editor & Recorder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-53211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Retrieve Embedded Sensitive Data.This issue affects Audio Editor & Recorder: from n/a through <= 2.2.3.
Product
Audio Editor & Recorder
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Audio Editor & Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Contentstudio: Missing AuthorizationCVE-2025-49990 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contentstudio: from n/a through <= 1.3.7.
Product
Contentstudio
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Contentstudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 14, 2025DIOT SCADA with MQTT: Stored Cross-Site ScriptingCVE-2025-4216 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DIOT SCADA with MQTT
Affected
up to 1.0.5.1
What to do
Affects up to 1.0.5.1. Update DIOT SCADA with MQTT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2025Audio Editor & Recorder: Missing AuthorizationCVE-2025-49509 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audio Editor & Recorder: from n/a through <= 2.2.1.
Product
Audio Editor & Recorder
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Audio Editor & Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025Sticky Radio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows Reflected XSS.This issue affects Sticky Radio Player: from n/a through <= 3.4.
Product
Sticky Radio Player
Affected
up to 3.4
What to do
Affects up to 3.4. Update Sticky Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Trinity Audio: Missing AuthorizationCVE-2025-49272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.20.0.
Product
Trinity Audio
Affected
up to 5.20.0
What to do
Affects up to 5.20.0. Update Trinity Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Bellows Accordion Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu allows Stored XSS.This issue affects Bellows Accordion Menu: from n/a through <= 1.4.3.
Product
Bellows Accordion Menu
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Bellows Accordion Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 30, 2025LA-Studio Element Kit for Elementor: Stored Cross-Site ScriptingCVE-2025-4944 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widgets in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 30, 2025LA-Studio Element Kit for Elementor: Stored Cross-Site ScriptingCVE-2025-4943 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-lakit-element-link’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2025Audio Comments: Cross-Site Request ForgeryCVE-2025-4189 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Audio Comments Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the 'audio-comments/audior-settings.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Audio Comments
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Audio Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 16, 2025Chameleon HTML5 Audio Player With/Without Playlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32307 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Chameleon HTML5 Audio Player With/Without Playlist lbg-audio1-html5 allows SQL Injection.This issue affects Chameleon HTML5 Audio Player With/Without Playlist: from n/a through <= 3.5.6.
Product
Chameleon HTML5 Audio Player With/Without Playlist
Affected
up to 3.5.6
What to do
Affects up to 3.5.6. Update Chameleon HTML5 Audio Player With/Without Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.