Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
147 results · page 2 of 3
Dec 13, 2025WP to LinkedIn Auto Publish: Reflected Cross-Site ScriptingCVE-2025-12077 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP to LinkedIn Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP to LinkedIn Auto Publish
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update WP to LinkedIn Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025Social Media Auto Publish: Reflected Cross-Site ScriptingCVE-2025-12076 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage parameter in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Social Media Auto Publish
- Affected
- up to 3.6.5
- What to do
- Affects up to 3.6.5. Update Social Media Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 25, 2025Peer Publish: Cross-Site Request ForgeryCVE-2025-12587 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Peer Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the website management pages. This makes it possible for unauthenticated attackers to add, modify, or delete website configurations via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
- Product
- Peer Publish
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Peer Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Unauthorized modification of dataCVE-2025-13149 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint.
- Product
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Nov 18, 2025WP Twitter Auto Publish: Reflected Cross-Site ScriptingCVE-2025-12079 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Twitter Auto Publish
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update WP Twitter Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 7, 2025WP2Social Auto Publish: Reflected Cross-Site ScriptingCVE-2025-12064 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP2Social Auto Publish
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update WP2Social Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025Gutenberg Blocks – PublishPress Blocks: Stored Cross-Site ScriptingCVE-2025-8588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenberg Blocks – PublishPress Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Marker Title' and 'Marker Description' parameters for the Maps block in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Gutenberg Blocks – PublishPress Blocks
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Gutenberg Blocks – PublishPress Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 22, 2025Bg Book Publisher: Stored Cross-Site ScriptingCVE-2025-11867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bg Book Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `book_author` post meta, rendered through the `[book_author]` shortcode, in all versions up to, and including, 1.25. This is due to the plugin not properly escaping the meta value before output. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bg Book Publisher
- Affected
- up to 1.25
- What to do
- Affects up to 1.25. Update Bg Book Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 3, 2025ContentMX Content Publisher: Cross-Site Request ForgeryCVE-2025-9889 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the cmx_activate_connection function. This makes it possible for unauthenticated attackers to bind their own ContentMX connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ContentMX Content Publisher
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update ContentMX Content Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2025Podlove Podcast Publisher: Arbitrary file uploadsCVE-2025-10147 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_as_original_file' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.2.6
- What to do
- Affects up to 4.2.6. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2025Publish approval: Cross-Site Request ForgeryCVE-2025-9617 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the publish_save_option function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Publish approval
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Publish approval to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2025Target Video Easy Publish: Missing AuthorizationCVE-2025-32688 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through <= 3.8.9.
- Product
- Target Video Easy Publish
- Affected
- up to 3.8.9
- What to do
- Affects up to 3.8.9. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule: Cross-Site Request Forgery (CSRF)CVE-2025-58846 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Dejan Markovic WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule buffer-my-post allows Reflected XSS.This issue affects WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule: from n/a through <= 2020.1.0.
- Product
- WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule
- Affected
- up to 2020.1.0
- What to do
- Affects up to 2020.1.0. Update WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2025Podlove Podcast Publisher: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-58204 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Phishing.This issue affects Podlove Podcast Publisher: from n/a through <= 4.2.5.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Pre-Publish Post Checklist: Missing AuthorizationCVE-2025-53323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist pre-publish-post-checklist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pre-Publish Post Checklist: from n/a through <= 3.1.
- Product
- Pre-Publish Post Checklist
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Pre-Publish Post Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2025Target Video Easy Publish: Stored Cross-Site ScriptingCVE-2025-5237 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Target Video Easy Publish
- Affected
- up to 3.8.5
- What to do
- Affects up to 3.8.5. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2025PressGrid - Frontend Publish Reaction & Multimedia: Deserialization of Untrusted DataCVE-2025-31429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1.
- Product
- PressGrid - Frontend Publish Reaction & Multimedia
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update PressGrid - Frontend Publish Reaction & Multimedia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Podlove Podcast Publisher: Does not sanitise and escape some of its settingsCVE-2024-13730 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Podlove Podcast Publisher
- Fixed in
- 4.2.1
- What to do
- Update Podlove Podcast Publisher to 4.2.1 or newer.
May 15, 2025Podlove Podcast Publisher: Does not sanitise and escape some of its settingsCVE-2024-13729 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Podlove Podcast Publisher
- Fixed in
- 4.1.24
- What to do
- Update Podlove Podcast Publisher to 4.1.24 or newer.
May 7, 2025PublishPress Authors: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47496 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress PublishPress Authors publishpress-authors allows PHP Local File Inclusion.This issue affects PublishPress Authors: from n/a through <= 4.7.5.
- Product
- PublishPress Authors
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025MPL-Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46226 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ferranfg MPL-Publisher mpl-publisher allows Stored XSS.This issue affects MPL-Publisher: from n/a through <= 2.18.0.
- Product
- MPL-Publisher
- Affected
- up to 2.18.0
- What to do
- Affects up to 2.18.0. Update MPL-Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025ContentMX Content Publisher: Missing AuthorizationCVE-2025-31555 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ContentMX ContentMX Content Publisher contentmx-content-publisher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ContentMX Content Publisher: from n/a through <= 1.0.6.
- Product
- ContentMX Content Publisher
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update ContentMX Content Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Print PDF Generator and Publisher: Cross-Site Request Forgery (CSRF)CVE-2025-22637 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Cross Site Request Forgery.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.2.0.
- Product
- Print PDF Generator and Publisher
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Print PDF Generator and Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025publish post email notification: Cross-Site Request Forgery (CSRF)CVE-2025-30816 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification publish-post-email-notification allows Cross Site Request Forgery.This issue affects publish post email notification: from n/a through <= 1.0.2.3.
- Product
- publish post email notification
- Affected
- up to 1.0.2.3
- What to do
- Affects up to 1.0.2.3. Update publish post email notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 15, 2025PublishPress Authors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26886 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors publishpress-authors allows SQL Injection.This issue affects PublishPress Authors: from n/a through <= 4.7.3.
- Product
- PublishPress Authors
- Affected
- up to 4.7.3
- What to do
- Affects up to 4.7.3. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2025Podlove Podcast Publisher: Cross-Site Request ForgeryCVE-2025-1383 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to missing or incorrect nonce validation on the ajax_transcript_delete() function. This makes it possible for unauthenticated attackers to delete arbitrary episode transcripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 13, 2025DX-auto-publish: Cross-Site Request Forgery (CSRF)CVE-2025-26577 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in daxiawp DX-auto-publish dx-auto-publish allows Stored XSS.This issue affects DX-auto-publish: from n/a through <= 1.2.
- Product
- DX-auto-publish
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DX-auto-publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2025Target Video Easy Publish: Stored Cross-Site ScriptingCVE-2024-13561 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's brid_override_yt shortcode in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Target Video Easy Publish
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 25, 2025Target Video Easy Publish: Cross-Site Request ForgeryCVE-2024-12076 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Target Video Easy Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the resync_carousel(), seek_snapshot(), uploaded_cc(), and remove_cc() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Target Video Easy Publish
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 18, 2025Podlove Podcast Publisher: Stored Cross-Site ScriptingCVE-2025-0554 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2025Email on Publish: Cross-Site Request Forgery (CSRF)CVE-2025-23673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dkukral Email on Publish email-on-publish allows Stored XSS.This issue affects Email on Publish: from n/a through <= 1.5.
- Product
- Email on Publish
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Email on Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Yumpu E-Paper publishing: Stored Cross-Site ScriptingCVE-2024-12621 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yumpu E-Paper publishing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'YUMPU' shortcode in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Yumpu E-Paper publishing
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Yumpu E-Paper publishing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025News Publisher Autopilot: Cross-Site Request Forgery (CSRF)CVE-2025-22557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in cdowp News Publisher Autopilot wpm-news-api allows Cross Site Request Forgery.This issue affects News Publisher Autopilot: from n/a through <= 2.1.4.
- Product
- News Publisher Autopilot
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update News Publisher Autopilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2024Bitcoin Lightning Publisher for: Reflected Cross-Site ScriptingCVE-2024-12100 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bitcoin Lightning Publisher for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Bitcoin Lightning Publisher for
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Bitcoin Lightning Publisher for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 20, 2024PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Sensitive Information ExposureCVE-2024-11154 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Affected
- up to 3.5.15
- What to do
- Affects up to 3.5.15. Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 19, 2024AgendaPress – Easily Publish Meeting Agendas and Programs on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51807 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Black and White AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress agendapress allows Stored XSS.This issue affects AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress: from n/a through <= 1.0.8.
- Product
- AgendaPress – Easily Publish Meeting Agendas and Programs on
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update AgendaPress – Easily Publish Meeting Agendas and Programs on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Print PDF Generator and Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52394 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Stored XSS.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.1.6.
- Product
- Print PDF Generator and Publisher
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Print PDF Generator and Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Podlove Podcast Publisher: Deserialization of Untrusted DataCVE-2024-52393 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through <= 4.1.15.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.1.15
- What to do
- Affects up to 4.1.15. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2024Podlove Podcast Publisher: Cross-Site Request Forgery (CSRF)CVE-2024-43984 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.1.13
- What to do
- Affects up to 4.1.13. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors: Insecure Direct Object Reference to Privilege Escalation/Account TakeoverCVE-2024-9215 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Reference to Privilege Escalation/Account Takeover in all versions up to, and including, 4.7.1 via the action_edited_author() due to missing validation on the 'authors-user_id' user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update arbitrary user accounts email addresses, including administrators, which can then be leveraged to reset that user's account password and gain access.
- Product
- Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Reflected Cross-Site ScriptingCVE-2024-9436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Affected
- up to 3.5.14
- What to do
- Affects up to 3.5.14. Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2024Social Web Suite – Social Media Auto Post, Social Media Auto Publish: Directory TraversalCVE-2024-8352 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Social Web Suite – Social Media Auto Post, Social Media Auto Publish
- Affected
- up to 4.1.11
- What to do
- Affects up to 4.1.11. Update Social Web Suite – Social Media Auto Post, Social Media Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 17, 2024Podlove Podcast Publisher: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43983 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.1.13
- What to do
- Affects up to 4.1.13. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2024The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnCVE-2024-6557 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and leaving the demo files in place with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2024Pre-Publish Checklist: Missing AuthorizationCVE-2023-44151 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Pre-Publish Checklist.This issue affects Pre-Publish Checklist: from n/a through 1.1.1.
- Product
- Pre-Publish Checklist
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Pre-Publish Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 11, 2024Podlove Podcast Publisher: Missing AuthorizationCVE-2024-32143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 9, 2024WP LinkedIn Auto Publish: Missing AuthorizationCVE-2024-32797 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Martin Gibson WP LinkedIn Auto Publish.This issue affects WP LinkedIn Auto Publish: from n/a through 8.11.
- Product
- WP LinkedIn Auto Publish
- Affected
- up to 8.11
- What to do
- Affects up to 8.11. Update WP LinkedIn Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 30, 2024Yumpu ePaper publishing: Unauthorized modification of dataCVE-2024-3277 · WordPress plugins & themes · reported by WordfenceMedium 5
The Yumpu ePaper publishing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versions up to, and including, 2.0.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload PDF files and publish them, as well as modify the API key.
- Product
- Yumpu ePaper publishing
- Affected
- up to 2.0.24
- What to do
- Affects up to 2.0.24. Update Yumpu ePaper publishing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 14, 2024Podlove Podcast Publisher: Missing AuthorizationCVE-2024-32712 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.14.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.0.14
- What to do
- Affects up to 4.0.14. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 7, 2024Tilda Publishing: Missing AuthorizationCVE-2023-31234 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Tilda Publishing.This issue affects Tilda Publishing: from n/a through 0.3.23.
- Product
- Tilda Publishing
- Affected
- up to 0.3.23
- What to do
- Affects up to 0.3.23. Update Tilda Publishing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.