Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,932 results · page 25 of 59
Mar 12, 2025NEX-Forms – Ultimate Form Builder – Contact forms and much more: Sensitive Information ExposureCVE-2024-13498 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.8.1 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form.
- Product
- NEX-Forms – Ultimate Form Builder – Contact forms and much more
- Affected
- up to 8.8.1
- What to do
- Affects up to 8.8.1. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 11, 2025A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below.CVE-2025-27591 · Other software · Meta Platforms, Inc · reported by cve-assign@fb.comMedium 6.8
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
- Product
- below
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Mar 10, 2025In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unCVE-2025-27926 · Other software · Nintex · reported by MITREMedium 4.3
In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.
- Product
- Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2025-26643 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute aCVE-2025-22212 · Other software · tassos.gr · reported by security@joomla.orgLow 2.7
A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend.
- Product
- Convert Forms component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory.CVE-2024-9135 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.3
On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing processing being terminated and route flapping.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in oCVE-2024-8000 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.3
On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart. Note: supplicants with pending captive-portal authentication during ASU would be impacted with this bug.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.CVE-2025-1260 · Other software · Arista Networks · reported by psirt@arista.comCritical 9.1
On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.CVE-2025-1259 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.7
On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in users retrieving data that should not have been available
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Rebrand Fluent Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23904 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rebrandpress Rebrand Fluent Forms rebrand-fluent-forms allows Reflected XSS.This issue affects Rebrand Fluent Forms: from n/a through <= 1.0.
- Product
- Rebrand Fluent Forms
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Rebrand Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025WAH Forms: Missing AuthorizationCVE-2025-23763 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Alex Volkov WAH Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WAH Forms: from n/a through 1.0.
- Product
- WAH Forms
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WAH Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2025SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity: Arbitrary file deletionCVE-2024-12544 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary file deletion due to a missing capability check on the callback function of the SurveyJS_DeleteFile class in all versions up to, and including, 1.12.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This function is still vulnerable to Cross-Site Request Forgery as of 1.12.20.
- Product
- SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity
- Affected
- up to 1.12.17
- What to do
- Affects up to 1.12.17. Update SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 27, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-0469 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.39.2
- What to do
- Affects up to 1.39.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause a NULL pointer exception by passing a malformed CVE-2024-53877 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause a NULL pointer exception by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELFCVE-2024-53876 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELCVE-2024-53875 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELCVE-2024-53874 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELCVE-2024-53872 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELFCVE-2024-53871 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELCVE-2024-53870 · Other software · NVIDIA · reported by psirt@nvidia.comLow 3.3
NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.
- Product
- CUDA Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough tCVE-2025-1675 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.2
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary file upload, read, and deletionCVE-2025-1128 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
- Product
- Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for
- Affected
- up to 3.0.9.4
- What to do
- Affects up to 3.0.9.4. Update Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 22, 2025Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Stored Cross-Site ScriptingCVE-2024-12038 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buddyforms_nav' shortcode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
- Affected
- up to 2.8.15
- What to do
- Affects up to 2.8.15. Update Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 20, 2025The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress CVE-2024-13818 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.4 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.
- Affected
- up to 3.8.4
- What to do
- Affects up to 3.8.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2025lakeFS is an open-source tool that transforms your object storage into a Git-like repository.CVE-2025-27100 · Other software · treeverse · reported by GitHubMedium 6.5
lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either set the environment variable `LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART` to `true` or configure the `disable_pre_signed_multipart` key to true in their config yaml.
- Product
- lakeFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.CVE-2025-25678 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.
- Product
- I12 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.CVE-2024-5705 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. (CWE-863) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, have modules enabled by default that allow execution of system level processes. When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service.
- Product
- Pentaho Data Integration & Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily: Stored Cross-Site ScriptingCVE-2024-12522 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2025Keap Official Opt-in Forms: Local File InclusionCVE-2024-13725 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution.
- Product
- Keap Official Opt-in Forms
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 17, 2025Wise Forms: Does not sanitise and escape some of its settingsCVE-2024-13603 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wise Forms WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks via malicious form submissions.
- Product
- Wise Forms
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Wise Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Forminator Forms: Does not sanitise and escape some of its settingsCVE-2024-7052 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Forminator Forms
- Fixed in
- 1.38.3
- What to do
- Update Forminator Forms to 1.38.3 or newer.
Feb 13, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-13125 · WordPress plugins & themes · reported by WPScanLow 3.5
The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Everest Forms
- Fixed in
- 3.0.8.1
- What to do
- Update Everest Forms to 3.0.8.1 or newer.
Feb 12, 2025In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an archiCVE-2025-0332 · Other software · Progress Software · reported by security@progress.comHigh 7.8
In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an archive's content into a restricted directory.
- Product
- Progress® Telerik® UI for WinForms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon: Unauthorized modification of dataCVE-2024-12164 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwp_reset_settings() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
- Product
- WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 11, 2025AForms Eats: Full Path DisclosureCVE-2024-13539 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /vendor/aura/payload-interface/phpunit.php file being publicly accessible and displaying error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- AForms Eats
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update AForms Eats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 5, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Sensitive Information ExposureCVE-2024-13829 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.0.8 via the 'attachments.php' file. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via forms.
- Product
- WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
- Affected
- up to 8.0.8
- What to do
- Affects up to 8.0.8. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 4, 2025WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: Stored Cross-Site ScriptingCVE-2024-13403 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all versions up to, and including, 1.9.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- Affected
- up to 1.9.3.1
- What to do
- Affects up to 1.9.3.1. Update WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2025Import Excel to Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allows Reflected XSS.This issue affects Import Excel to Gravity Forms: from n/a through <= 1.18.
- Product
- Import Excel to Gravity Forms
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Import Excel to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025BSK Forms Validation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Validation bsk-gravity-forms-custom-validation allows Reflected XSS.This issue affects BSK Forms Validation: from n/a through <= 1.7.
- Product
- BSK Forms Validation
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update BSK Forms Validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WordPress Contact Forms by Cimatti: Unauthorized access of dataCVE-2024-12184 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the accua_forms_download_submitted_file() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to download other user submitted forms.
- Product
- WordPress Contact Forms by Cimatti
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update WordPress Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 31, 2025IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting.CVE-2024-49349 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Financial Transaction Manager for SWIFT Services for Multiplatforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting.CVE-2024-49339 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.4
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- Product
- Financial Transaction Manager for SWIFT Services for Multiplatforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2025Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Stored Cross-Site ScriptingCVE-2024-12037 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bf_new_submission_link' shortcode in all versions up to, and including, 2.8.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
- Affected
- up to 2.8.13
- What to do
- Affects up to 2.8.13. Update Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 30, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Reflected Cross-Site ScriptingCVE-2025-0470 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.38.2
- What to do
- Affects up to 1.38.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 30, 2025The Contact Form & SMTP Plugin for WordPress by PirateForms: Arbitrary shortcode executionCVE-2024-13453 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Contact Form & SMTP Plugin for WordPress by PirateForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Contact Form & SMTP Plugin for WordPress by PirateForms
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update The Contact Form & SMTP Plugin for WordPress by PirateForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 30, 2025Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2024-13470 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ninja Forms – The Contact Form Builder That Grows With You
- Affected
- up to 3.8.24
- What to do
- Affects up to 3.8.24. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 29, 2025A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locationsCVE-2025-0851 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9.3
A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
- Product
- DeepJavaLibrary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Jan 27, 2025WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24708 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-dynamics-crm allows Reflected XSS.This issue affects WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.6.
- Product
- WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access toCVE-2021-42718 · Other software · Replicated · reported by security@replicated.comMedium 4.9
Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin Console API on port 8800. This CVE was originally reserved in 2021 and later publicly disclosed by Replicated on their website on 21 October 2021. However, it mistakenly remained in the Reserved But Public (RBP) status with the CVE Numbering Authority (CNA). Please note that this product reached its end of life on 31 December 2024. Publishing this CVE with the CNA was required to comply with CNA rules, despite the fact that the issue was disclosed and fixed four years ago, and the affected product is no longer supported as of 2024. Summary of VulnerabilityThis advisory discloses a low severity security vulnerability in the versions of Replicated Classic listed above (“Affected Replicated Classic Versions”) DescriptionReplicated Classic versions prior to 2.53.1 have an authenticated API from the Replicated Admin Console that may expose sensitive data including application secrets, depend
- Product
- Replicated Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025Multi Uploader for Gravity Forms: Unrestricted Upload of File with Dangerous TypeCVE-2025-23921 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: from n/a through <= 1.1.3.
- Product
- Multi Uploader for Gravity Forms
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Multi Uploader for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.