Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

3,184 results · page 20 of 64

Apr 10, 2025Feedify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13874 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Feedify
Fixed in
2.4.6
What to do
Update Feedify to 2.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 9, 2025KeyCAPTCHA: Cross-Site Request Forgery (CSRF)CVE-2025-32619 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in KeyCAPTCHA KeyCAPTCHA keycaptcha allows Stored XSS.This issue affects KeyCAPTCHA: from n/a through <= 2.5.1.
Product
KeyCAPTCHA
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update KeyCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025reCAPTCHA Jetpack: Cross-Site Request Forgery (CSRF)CVE-2025-32494 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bozdoz reCAPTCHA Jetpack recaptcha-jetpack allows Cross Site Request Forgery.This issue affects reCAPTCHA Jetpack: from n/a through <= 0.2.2.
Product
reCAPTCHA Jetpack
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Maps: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-2279 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Maps
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Apr 3, 2025MapPress Maps for: Does not sanitise and escape some parametersCVE-2025-2055 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
MapPress Maps for
Fixed in
2.94.9
What to do
Update MapPress Maps for to 2.94.9 or newer.
Full record and what to do →NVD record wpscan.com
Apr 1, 2025Gutentor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-1986 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Gutentor
Fixed in
3.4.7
What to do
Update Gutentor to 3.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 31, 2025Photo Gallery by 10Web: Does not sanitised and escaped comment added on images by unauthenticated usersCVE-2025-0613 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed
Product
Photo Gallery by 10Web
Fixed in
1.8.34
What to do
Update Photo Gallery by 10Web to 1.8.34 or newer.
Full record and what to do →NVD record wpscan.com
Mar 28, 2025Advanced Google reCAPTCHA: Generic SQL InjectionCVE-2025-2074 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.29 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries, particularly when the plugin’s settings page hasn’t been visited and its welcome message has not been dismissed. This issue can be used to extract sensitive information from the database.
Product
Advanced Google reCAPTCHA
Affected
up to 1.29
What to do
Affects up to 1.29. Update Advanced Google reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 27, 2025reCAPTCHA for all: Cross-Site Request Forgery (CSRF)CVE-2025-30862 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA for all: from n/a through <= 2.22.
Product
reCAPTCHA for all
Affected
up to 2.22
What to do
Affects up to 2.22. Update reCAPTCHA for all to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Are you robot google recaptcha for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28928 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Are you robot google recaptcha for wordpress are-you-robot-recaptcha allows Reflected XSS.This issue affects Are you robot google recaptcha for wordpress: from n/a through <= 2.2.
Product
Are you robot google recaptcha for
Affected
up to 2.2
What to do
Affects up to 2.2. Update Are you robot google recaptcha for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Blue Captcha: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28880 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jotis Blue Captcha blue-captcha allows Reflected XSS.This issue affects Blue Captcha: from n/a through <= 1.7.4.
Product
Blue Captcha
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Blue Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Smart Maintenance Mode: Does not sanitise and escape some of its settingsCVE-2024-12683 · WordPress plugins & themes · reported by WPScanLow 3.5
The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Smart Maintenance Mode
Fixed in
1.5.2
What to do
Update Smart Maintenance Mode to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site SCVE-2025-1798 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks.
Fixed in
1.1.2
What to do
Update the plugin to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Favorites: Does not sanitise and escape some of its settingsCVE-2025-1452 · WordPress plugins & themes · reported by WPScanLow 3.5
The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Favorites
Fixed in
2.3.5
What to do
Update Favorites to 2.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025WP-Recall: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9770 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
WP-Recall
Fixed in
16.26.12
What to do
Update WP-Recall to 16.26.12 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Stylish Google Sheet Reader 4.0: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13863 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Stylish Google Sheet Reader 4.0
Fixed in
4.1
What to do
Update Stylish Google Sheet Reader 4.0 to 4.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025AFI: Does not sanitise and escape some of its settingsCVE-2024-13123 · WordPress plugins & themes · reported by WPScanLow 3.5
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
AFI
Fixed in
1.100.0
What to do
Update AFI to 1.100.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025AFI: Does not sanitise and escape some of its settingsCVE-2024-13122 · WordPress plugins & themes · reported by WPScanLow 3.5
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
AFI
Fixed in
1.100.0
What to do
Update AFI to 1.100.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Simple Banner: Does not sanitise and escape some of its settingsCVE-2024-12769 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple Banner
Fixed in
3.0.4
What to do
Update Simple Banner to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Smart Maintenance Mode: Does not sanitise and escape some of its settingsCVE-2024-12682 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Smart Maintenance Mode
Fixed in
1.5.2
What to do
Update Smart Maintenance Mode to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Product Labels For Woocommerce (Sale Badges): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12109 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Product Labels For Woocommerce (Sale Badges)
Fixed in
1.5.9
What to do
Update Product Labels For Woocommerce (Sale Badges) to 1.5.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2025WP Tabs: Does not sanitise and escape some of its settingsCVE-2024-11503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Tabs
Fixed in
2.2.7
What to do
Update WP Tabs to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11273 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Registrations for the Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-10703 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Registrations for the Events Calendar
Fixed in
2.13.4
What to do
Update Registrations for the Events Calendar to 2.13.4 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-10679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Quiz and Survey Master (QSM)
Fixed in
9.2.1
What to do
Update Quiz and Survey Master (QSM) to 9.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Product Labels For Woocommerce (Sale Badges): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10638 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Product Labels For Woocommerce (Sale Badges)
Fixed in
1.5.11
What to do
Update Product Labels For Woocommerce (Sale Badges) to 1.5.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2025Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10566 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider by 10Web
Fixed in
1.2.62
What to do
Update Slider by 10Web to 1.2.62 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10565 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider by 10Web
Fixed in
1.2.62
What to do
Update Slider by 10Web to 1.2.62 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10560 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.30
What to do
Update Form Maker by 10Web to 1.15.30 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025WordPress WP-Advanced-Search: Does not sanitise and escape some of its settingsCVE-2024-10554 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WordPress WP-Advanced-Search
Fixed in
3.3.9.3
What to do
Update WordPress WP-Advanced-Search to 3.3.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Stylish Price List: Does not sanitise and escape some of its settingsCVE-2024-10472 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Stylish Price List
Fixed in
7.1.12
What to do
Update Stylish Price List to 7.1.12 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Job Postings: Does not sanitise and escape some of its settingsCVE-2024-10105 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Job Postings
Fixed in
2.7.11
What to do
Update Job Postings to 2.7.11 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025AlphaOmega Captcha & Anti-Spam Filter: Cross-Site Request Forgery (CSRF)CVE-2025-30584 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through <= 3.3.
Product
AlphaOmega Captcha & Anti-Spam Filter
Affected
up to 3.3
What to do
Affects up to 3.3. Update AlphaOmega Captcha & Anti-Spam Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Image Captcha: Cross-Site Request Forgery (CSRF)CVE-2025-30534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha: from n/a through <= 1.2.
Product
Image Captcha
Affected
up to 1.2
What to do
Affects up to 1.2. Update Image Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its settingsCVE-2025-1203 · WordPress plugins & themes · reported by WPScanLow 3.5
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider, Gallery, and Carousel by MetaSlider
Fixed in
3.95.0
What to do
Update Slider, Gallery, and Carousel by MetaSlider to 3.95.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its settingsCVE-2025-1062 · WordPress plugins & themes · reported by WPScanLow 3.5
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Slider, Gallery, and Carousel by MetaSlider
Fixed in
3.95.0
What to do
Update Slider, Gallery, and Carousel by MetaSlider to 3.95.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13124 · WordPress plugins & themes · reported by WPScanLow 3.5
The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.33
What to do
Update Photo Gallery by 10Web to 1.8.33 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10558 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.30
What to do
Update Form Maker by 10Web to 1.15.30 or newer.
Full record and what to do →NVD record wpscan.com
Mar 23, 2025Pods: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-1446 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Pods
Fixed in
3.2.8.2
What to do
Update Pods to 3.2.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 23, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2025-0718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Nested Pages
Fixed in
3.2.13
What to do
Update Nested Pages to 3.2.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 22, 2025Gotcha | Gesture-based Captcha: Reflected Cross-Site ScriptingCVE-2025-2482 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Gotcha | Gesture-based Captcha plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menu' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Gotcha | Gesture-based Captcha
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Gotcha | Gesture-based Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 20, 2025Link My Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13881 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Link My Posts
Affected
up to 1.0
What to do
Affects up to 1.0. Update Link My Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025My Quota: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13880 · WordPress plugins & themes · reported by WPScanHigh 7.1
The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
My Quota
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update My Quota to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025SpotBot: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13878 · WordPress plugins & themes · reported by WPScanHigh 7.1
The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
SpotBot
Affected
up to 0.1.8
What to do
Affects up to 0.1.8. Update SpotBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025Passbeemedia Web Push Notification: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13877 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Passbeemedia Web Push Notification
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Passbeemedia Web Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025mEintopf: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13876 · WordPress plugins & themes · reported by WPScanHigh 7.1
The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
mEintopf
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update mEintopf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 20, 2025WP-PManager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13875 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP-PManager
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 19, 2025Site Reviews: Does not properly sanitise and escape some of its Review fieldsCVE-2025-1232 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks
Product
Site Reviews
Fixed in
7.2.5
What to do
Update Site Reviews to 7.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1624 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
GDPR Cookie Compliance
Fixed in
4.15.9
What to do
Update GDPR Cookie Compliance to 4.15.9 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.