Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

166 results · page 2 of 4

Aug 2, 2025ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization: Stored Cross-Site ScriptingCVE-2025-6626 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
Affected
up to 3.10.3
What to do
Affects up to 3.10.3. Update ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2025BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript: Arbitrary file uploadsCVE-2025-7443 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
Affected
up to 2.2.42
What to do
Affects up to 2.2.42. Update BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2025Import CDN-Remote Images: Cross-Site Request Forgery (CSRF)CVE-2025-48153 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au Import CDN-Remote Images import-cdn-remote-images allows Stored XSS.This issue affects Import CDN-Remote Images: from n/a through <= 2.1.2.
Product
Import CDN-Remote Images
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Import CDN-Remote Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025iFrame Images Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30969 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus iFrame Images Gallery wp-iframe-images-gallery allows SQL Injection.This issue affects iFrame Images Gallery: from n/a through <= 9.0.
Product
iFrame Images Gallery
Affected
up to 9.0
What to do
Affects up to 9.0. Update iFrame Images Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Auto Upload Images: Server-Side Request Forgery (SSRF)CVE-2025-49985 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Ali Irani Auto Upload Images auto-upload-images allows Server Side Request Forgery.This issue affects Auto Upload Images: from n/a through <= 3.3.2.
Product
Auto Upload Images
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Auto Upload Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Pixabay Images: Arbitrary file uploadsCVE-2025-4413 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabay_upload function in all versions up to, and including, 3.4. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Pixabay Images
Affected
up to 3.4
What to do
Affects up to 3.4. Update Pixabay Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 19, 2025Remote Images Grabber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43832 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyk Remote Images Grabber remote-images-grabber allows Reflected XSS.This issue affects Remote Images Grabber: from n/a through <= 0.6.
Product
Remote Images Grabber
Affected
up to 0.6
What to do
Affects up to 0.6. Update Remote Images Grabber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-13384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.24
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-10144 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.22
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2025Carousel-of-post-images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RichardHarrison Carousel-of-post-images carousel-of-post-images allows DOM-Based XSS.This issue affects Carousel-of-post-images: from n/a through <= 1.07.
Product
Carousel-of-post-images
Affected
up to 1.07
What to do
Affects up to 1.07. Update Carousel-of-post-images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025WooCommerce Products without featured images: Cross-Site Request Forgery (CSRF)CVE-2025-32545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in SOFTAGON WooCommerce Products without featured images woocommerce-products-without-featured-images allows Reflected XSS.This issue affects WooCommerce Products without featured images: from n/a through <= 0.1.
Product
WooCommerce Products without featured images
Affected
up to 0.1
What to do
Affects up to 0.1. Update WooCommerce Products without featured images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025404 Image Redirection (Replace Broken Images): Cross-Site Request Forgery (CSRF)CVE-2025-32266 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) broken-images-redirection allows Cross Site Request Forgery.This issue affects 404 Image Redirection (Replace Broken Images): from n/a through <= 1.4.
Product
404 Image Redirection (Replace Broken Images)
Affected
up to 1.4
What to do
Affects up to 1.4. Update 404 Image Redirection (Replace Broken Images) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025ShortPixel Adaptive Images: Missing AuthorizationCVE-2025-30853 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.10.0.
Product
ShortPixel Adaptive Images
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Automatic Featured Images from Videos: Missing AuthorizationCVE-2025-31820 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.4.
Product
Automatic Featured Images from Videos
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Automatic Featured Images from Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Photo Gallery by 10Web: Does not sanitised and escaped comment added on images by unauthenticated usersCVE-2025-0613 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed
Product
Photo Gallery by 10Web
Fixed in
1.8.34
What to do
Update Photo Gallery by 10Web to 1.8.34 or newer.
Full record and what to do →NVD record wpscan.com
Mar 3, 2025ChatGPT Open AI Images & Content for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mauricio Urrego ChatGPT Open AI Images & Content for WooCommerce glasses-for-woocommerce allows Reflected XSS.This issue affects ChatGPT Open AI Images & Content for WooCommerce: from n/a through <= 2.2.0.
Product
ChatGPT Open AI Images & Content for WooCommerce
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update ChatGPT Open AI Images & Content for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025ntp-header-images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nord_tramper ntp-header-images header-images-rotator allows Reflected XSS.This issue affects ntp-header-images: from n/a through <= 1.2.
Product
ntp-header-images
Affected
up to 1.2
What to do
Affects up to 1.2. Update ntp-header-images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Add Linked Images To Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-27277 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in tiefpunkt Add Linked Images To Gallery add-linked-images-to-gallery-v01 allows Cross Site Request Forgery.This issue affects Add Linked Images To Gallery: from n/a through <= 1.4.
Product
Add Linked Images To Gallery
Affected
up to 1.4
What to do
Affects up to 1.4. Update Add Linked Images To Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 12, 2025All-Images.ai – IA Image Bank and Custom Image creation: Arbitrary file uploadsCVE-2024-13714 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_get_image_by_url' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
All-Images.ai – IA Image Bank and Custom Image creation
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update All-Images.ai – IA Image Bank and Custom Image creation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 27, 2025The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploadedCVE-2024-13117 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded
Product
Social Share Buttons for
Affected
up to 2.7
What to do
Affects up to 2.7. Update Social Share Buttons for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 7, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its Gallery settingsCVE-2024-10102 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.22
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 7, 2025LazyLoad Background Images: Unauthorized modification of dataCVE-2024-12327 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LazyLoad Background Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pblzbg_save_settings() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
LazyLoad Background Images
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update LazyLoad Background Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025Gallery Images Ape: Missing AuthorizationCVE-2022-41995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Galleryape Gallery Images Ape allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gallery Images Ape: from n/a through 2.2.8.
Product
Gallery Images Ape
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Gallery Images Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Acme Fix Images: Missing AuthorizationCVE-2023-47793 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Acme Themes Acme Fix Images acme-fix-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through <= 1.0.0.
Product
Acme Fix Images
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Acme Fix Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Branded Social Images: Missing AuthorizationCVE-2023-28536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Acato Branded Social Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Branded Social Images: from n/a through 1.1.0.
Product
Branded Social Images
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Branded Social Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 25, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Images settingsCVE-2024-6393 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery, Sliders, Proofing and
Fixed in
3.59.5
What to do
Update Photo Gallery, Sliders, Proofing and to 3.59.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 9, 2024SrcSet Responsive Images for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ben.moody SrcSet Responsive Images for WordPress truenorth-srcset allows Reflected XSS.This issue affects SrcSet Responsive Images for WordPress: from n/a through <= 1.4.
Product
SrcSet Responsive Images for
Affected
up to 1.4
What to do
Affects up to 1.4. Update SrcSet Responsive Images for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2024AI Image Generator for Your Content & Featured Images – AI Postpix: Unrestricted Upload of File with Dangerous TypeCVE-2024-49671 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Dogu Pekgoz AI Image Generator for Your Content & Featured Images – AI Postpix ai-postpix allows Upload a Web Shell to a Web Server.This issue affects AI Image Generator for Your Content & Featured Images – AI Postpix: from n/a through <= 1.1.8.
Product
AI Image Generator for Your Content & Featured Images – AI Postpix
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update AI Image Generator for Your Content & Featured Images – AI Postpix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024Bulk images optimizer: Resize, optimize, convert to webp, rename …: Unauthorized modification of dataCVE-2024-9361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_configuration' function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options.
Product
Bulk images optimizer: Resize, optimize, convert to webp, rename …
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Bulk images optimizer: Resize, optimize, convert to webp, rename … to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024ACF Images Search And Insert: Unrestricted Upload of File with Dangerous TypeCVE-2024-48035 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in takayukii ACF Images Search And Insert acf-images-search-and-insert allows Upload a Web Shell to a Web Server.This issue affects ACF Images Search And Insert: from n/a through <= 1.1.4.
Product
ACF Images Search And Insert
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update ACF Images Search And Insert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Unauthorized access of dataCVE-2024-8431 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.21
What to do
Affects up to 3.2.21. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2024BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript: Reflected Cross-Site ScriptingCVE-2024-9344 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2024Generate Images: Does not sanitise and escape some of its settingsCVE-2024-6724 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Generate Images WordPress plugin before 5.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Generate Images
Fixed in
5.2.8
What to do
Update Generate Images to 5.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Stored Cross-Site ScriptingCVE-2024-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the Gallery title field in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2024Optimize Images ALT Text (alt tag) & names for SEO using AI: Full Path DisclosureCVE-2024-6571 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.1. This is due the plugin utilizing cocur and not preventing direct access to the generate-default.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Optimize Images ALT Text (alt tag) & names for SEO using AI
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Optimize Images ALT Text (alt tag) & names for SEO using AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Comment Images Reloaded: Unauthorized loss of dataCVE-2024-5856 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cir_delete_image AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary media attachments.
Product
Comment Images Reloaded
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Comment Images Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 8, 2024Media Hygiene: Remove or Delete Unused Images and More!: Unauthorized loss of dataCVE-2024-5855 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the bulk_action_delete and delete_single_image_call AJAX actions in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments. A nonce check was added in version 3.0.1, however, it wasn't until version 3.0.2 that a capability check was added.
Product
Media Hygiene: Remove or Delete Unused Images and More!
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Media Hygiene: Remove or Delete Unused Images and More! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 21, 2024WP SVG Images: Stored Cross-Site ScriptingCVE-2024-5945 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissions to upload sanitized files, to bypass SVG sanitization and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A bypass to the patch in version 4.3 was discovered and fixed completely in version 4.4.
Product
WP SVG Images
Affected
up to 4.3
What to do
Affects up to 4.3. Update WP SVG Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Stored Cross-Site ScriptingCVE-2024-3894 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an Image Title in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Cross-Site Request ForgeryCVE-2024-5343 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.19. This is due to missing or incorrect nonce validation on the 'rbs_ajax_create_article' and 'rbs_ajax_reset_views' functions. This makes it possible for unauthenticated attackers to create new posts and reset gallery view counts via a forged request granted they can trick a Contributor+ level user into performing an action such as clicking on a link.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 3, 2024ImageMagick Sharpen Resized Images: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34790 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hans van Eijsden,niwreg ImageMagick Sharpen Resized Images allows Stored XSS.This issue affects ImageMagick Sharpen Resized Images: from n/a through 1.1.7.
Product
ImageMagick Sharpen Resized Images
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update ImageMagick Sharpen Resized Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 1, 2024QQWorld Auto Save Images: Unauthorized access of dataCVE-2024-1324 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The QQWorld Auto Save Images plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the save_remote_images_get_auto_saved_results() function hooked via a norpriv AJAX in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to retrieve the contents of arbitrary posts that may not be public.
Product
QQWorld Auto Save Images
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update QQWorld Auto Save Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 17, 2024Instant Images: Improper Privilege ManagementCVE-2024-33569 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Privilege Management vulnerability in Darren Cooney Instant Images allows Privilege Escalation.This issue affects Instant Images: from n/a through 6.1.0.
Product
Instant Images
Affected
up to 6.1.0
What to do
Affects up to 6.1.0. Update Instant Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024ShortPixel Adaptive Images: Cross-Site Request Forgery (CSRF)CVE-2024-4689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.
Product
ShortPixel Adaptive Images
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024ShortPixel Adaptive Images: Server-Side Request Forgery (SSRF)CVE-2024-35172 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.
Product
ShortPixel Adaptive Images
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 23, 2024Quick Featured Images: Unauthorized modification of dataCVE-2024-3664 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and delete_thumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author.
Product
Quick Featured Images
Affected
up to 13.7.0
What to do
Affects up to 13.7.0. Update Quick Featured Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 15, 2024Broken Images: Cross-Site Request Forgery (CSRF)CVE-2024-31093 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kaloyan K. Tsvetkov Broken Images allows Cross-Site Scripting (XSS).This issue affects Broken Images: from n/a through 0.2.
Product
Broken Images
Affected
up to 0.2
What to do
Affects up to 0.2. Update Broken Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024ShortPixel Adaptive Images: Missing AuthorizationCVE-2024-31230 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.2.
Product
ShortPixel Adaptive Images
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels: Unauthorized arbitrary options updateCVE-2024-0869 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the instant-images/license REST API endpoint in all versions up to, and including, 6.1.0. This makes it possible for authors and higher to update arbitrary options. CVE-2024-33569 appears to be a duplicate of this issue.
Product
Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels
Affected
up to 6.1.0
What to do
Affects up to 6.1.0. Update Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22295 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery allows Stored XSS.This issue affects Photo Gallery, Images, Slider in Rbs Image Gallery: from n/a through 3.2.17.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.17
What to do
Affects up to 3.2.17. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.