Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,856 results · page 25 of 58

Mar 8, 2025All-in-One Addons for Elementor – WidgetKit: Sensitive Information ExposureCVE-2024-10321 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 in elements/advanced-tab/template/view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
All-in-One Addons for Elementor – WidgetKit
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update All-in-One Addons for Elementor – WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 8, 2025Post SMTP: Generic SQL InjectionCVE-2024-13844 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Post SMTP
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Mar 8, 2025Print Invoice & Delivery Notes for WooCommerce: Sensitive Information ExposureCVE-2024-13640 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.4.1 via the 'wcdn/invoice' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/wcdn/invoice directory which can contain invoice files if an email attachment setting is enabled.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025Post Lockdown: Information ExposureCVE-2025-1504 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocomplete' AJAX action due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Post Lockdown
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Post Lockdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 7, 2025Post Meta Data Manager: Multisite privilege escalationCVE-2024-13835 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying the existence of a multisite installation prior to allowing user meta to be added/modified. This makes it possible for authenticated attackers, with Administrator-level access and above, to gain elevated privileges on subsites that would otherwise be inaccessible.
Product
Post Meta Data Manager
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 7, 2025Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins: Cross-Site Request ForgeryCVE-2024-12634 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 2.0.59. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins
Affected
up to 2.0.59
What to do
Affects up to 2.0.59. Update Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025VK Blocks: Sensitive Information ExposureCVE-2024-13635 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private posts and pages.
Product
VK Blocks
Affected
up to 1.94.2.2
What to do
Affects up to 1.94.2.2. Update VK Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2025Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More: Sensitive Information ExposureCVE-2024-11153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.0 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
Product
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 5, 2025VEDA - MultiPurpose: PHP Object InjectionCVE-2024-13787 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'veda_backup_and_restore_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
VEDA - MultiPurpose
Affected
up to 4.2
What to do
Affects up to 4.2. Update VEDA - MultiPurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 3, 2025Migrate Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Migrate Posts migrate-post allows Reflected XSS.This issue affects Migrate Posts: from n/a through <= 1.0.
Product
Migrate Posts
Affected
up to 1.0
What to do
Affects up to 1.0. Update Migrate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP Easy Post Mailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23956 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman WP Easy Post Mailer wp-mailer allows Reflected XSS.This issue affects WP Easy Post Mailer: from n/a through <= 0.64.
Product
WP Easy Post Mailer
Affected
up to 0.64
What to do
Affects up to 0.64. Update WP Easy Post Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP Post Category Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23586 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MAL73049 WP Post Category Notifications wp-post-category-notifications allows Reflected XSS.This issue affects WP Post Category Notifications: from n/a through <= 1.0.
Product
WP Post Category Notifications
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Post Category Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Google Map on Post/Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23517 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunil chaulagain Google Map on Post/Page google-map-on-postpage allows Reflected XSS.This issue affects Google Map on Post/Page: from n/a through <= 1.1.
Product
Google Map on Post/Page
Affected
up to 1.1
What to do
Affects up to 1.1. Update Google Map on Post/Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Attach Gallery Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23441 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dkukral Attach Gallery Posts attach-gallery-posts allows Reflected XSS.This issue affects Attach Gallery Posts: from n/a through <= 1.6.
Product
Attach Gallery Posts
Affected
up to 1.6
What to do
Affects up to 1.6. Update Attach Gallery Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 1, 2025WP Posts Carousel: Stored Cross-Site ScriptingCVE-2025-1491 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Posts Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play_timeout’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Posts Carousel
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 1, 2025GenerateBlocks: Sensitive Information ExposureCVE-2024-13546 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.1 via the 'get_image_description' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private, draft, and scheduled posts and pages.
Product
GenerateBlocks
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update GenerateBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2025Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: Sensitive Information ExposureCVE-2024-13611 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/bp-better-messages directory which can contain file attachments included in chat messages.
Product
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2025Database Backup and check Tables Automated With Scheduler 2024: Sensitive Information ExposureCVE-2024-13911 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials.
Product
Database Backup and check Tables Automated With Scheduler 2024
Affected
up to 2.35
What to do
Affects up to 2.35. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2025Fluent Support – Helpdesk & Customer Support Ticket System: Sensitive Information ExposureCVE-2024-13568 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory which can contain file attachments included in support tickets.
Product
Fluent Support – Helpdesk & Customer Support Ticket System
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Fluent Support – Helpdesk & Customer Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025Ultra Addons Lite for Elementor: Information ExposureCVE-2024-13832 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'ut_elementor' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Ultra Addons Lite for Elementor
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Ultra Addons Lite for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Order Attachments for WooCommerce: Sensitive Information ExposureCVE-2024-13638 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments added to orders.
Product
Order Attachments for WooCommerce
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Order Attachments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Post Grid and Gutenberg Blocks – ComboBlocks: Sensitive Information ExposureCVE-2024-13796 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.6 via the /wp-json/post-grid/v2/get_users REST API This makes it possible for unauthenticated attackers to extract sensitive data including including emails and other user data.
Product
Post Grid and Gutenberg Blocks – ComboBlocks
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Post Grid and Gutenberg Blocks – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025Jeg Elementor Kit: Sensitive Information ExposureCVE-2024-13217 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expired_data' and 'build_content' functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
Product
Jeg Elementor Kit
Affected
up to 2.6.11
What to do
Affects up to 2.6.11. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 26, 2025Post Sync: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13634 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Post Sync
Affected
up to 1.1
What to do
Affects up to 1.1. Update Post Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Post Timeline: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13571 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Post Timeline
Fixed in
2.3.10
What to do
Update Post Timeline to 2.3.10 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025SureMembers: Sensitive Information ExposureCVE-2024-12434 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.6 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive data including restricted content.
Product
SureMembers
Affected
up to 1.10.6
What to do
Affects up to 1.10.6. Update SureMembers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record suremembers.com wordfence.com
Feb 26, 2025WooCommerce Cart Count Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10563 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WooCommerce Cart Count Shortcode
Fixed in
1.1.0
What to do
Update WooCommerce Cart Count Shortcode to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Feb 25, 2025System Dashboard: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26911 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.
Product
System Dashboard
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Classified Listing – Classified ads & Business Directory: Sensitive Information ExposureCVE-2025-1063 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens.
Product
Classified Listing – Classified ads & Business Directory
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 24, 2025Get Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nurelm Get Posts nurelm-get-posts allows Stored XSS.This issue affects Get Posts: from n/a through <= 0.6.
Product
Get Posts
Affected
up to 0.6
What to do
Affects up to 0.6. Update Get Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025WP-PostRatings Cheater: Cross-Site Request Forgery (CSRF)CVE-2025-27328 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in queeez WP-PostRatings Cheater wp-postratings-cheater allows Cross Site Request Forgery.This issue affects WP-PostRatings Cheater: from n/a through <= 1.5.
Product
WP-PostRatings Cheater
Affected
up to 1.5
What to do
Affects up to 1.5. Update WP-PostRatings Cheater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025WP Video Posts: Cross-Site Request Forgery (CSRF)CVE-2025-27298 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Cross-Site Request Forgery (CSRF) vulnerability in cmstactics WP Video Posts wp-video-posts allows OS Command Injection.This issue affects WP Video Posts: from n/a through <= 3.5.1.
Product
WP Video Posts
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update WP Video Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025VG PostCarousel: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-27272 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in vinagecko VG PostCarousel vg-postcarousel allows PHP Local File Inclusion.This issue affects VG PostCarousel: from n/a through <= 1.1.
Product
VG PostCarousel
Affected
up to 1.1
What to do
Affects up to 1.1. Update VG PostCarousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-12308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Logo Slider
Fixed in
4.6.0
What to do
Update Logo Slider to 4.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Feb 22, 2025A1POST.BG Shipping for Woo: Cross-Site Request Forgery (CSRF)CVE-2025-27012 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo a1post-bg-shipping-for-woocommerce allows Privilege Escalation.This issue affects A1POST.BG Shipping for Woo: from n/a through <= 1.5.
Product
A1POST.BG Shipping for Woo
Affected
up to 1.5
What to do
Affects up to 1.5. Update A1POST.BG Shipping for Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 22, 2025Vitepos: Missing AuthorizationCVE-2025-26750 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vitepos: from n/a through <= 3.1.3.
Product
Vitepos
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 22, 2025IP2Location Country Blocker: Regular Information ExposureCVE-2025-1361 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings.
Product
IP2Location Country Blocker
Affected
up to 2.38.8
What to do
Affects up to 2.38.8. Update IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 22, 2025Post Grid and Gutenberg Blocks – ComboBlocks: Unauthorized order creationCVE-2024-13798 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible for unauthenticated attackers to create new orders for products and mark them as paid without actually completing a payment.
Product
Post Grid and Gutenberg Blocks – ComboBlocks
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Post Grid and Gutenberg Blocks – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 22, 2025Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Stored Cross-Site ScriptingCVE-2024-12038 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buddyforms_nav' shortcode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Affected
up to 2.8.15
What to do
Affects up to 2.8.15. Update Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 21, 2025The Custom Post Type Date Archives: Arbitrary shortcode executionCVE-2025-1510 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Custom Post Type Date Archives
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update The Custom Post Type Date Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 21, 2025Head, Footer and Post Injections: PHP Code InjectionCVE-2024-13900 · WordPress plugins & themes · reported by WordfenceMedium 4.1
The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject PHP Code in multisite environments.
Product
Head, Footer and Post Injections
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Head, Footer and Post Injections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025Newpost Catch: Stored Cross-Site ScriptingCVE-2025-1406 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, and including, 1.3.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Newpost Catch
Affected
up to 1.3.19
What to do
Affects up to 1.3.19. Update Newpost Catch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 20, 2025Content Blocks (Custom Post Widget): Stored Cross-Site ScriptingCVE-2024-6432 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's shortcode Content Block in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Content Blocks (Custom Post Widget)
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update Content Blocks (Custom Post Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025ElementsKit Elementor addons: Sensitive Information ExposureCVE-2025-0968 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a missing capability checks on the get_megamenu_content() function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, trashed and private items.
Product
ElementsKit Elementor addons
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update ElementsKit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Team Builder For WPBakery Page Builder(Formerly Visual Composer): Local File InclusionCVE-2024-13592 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'team-builder-vc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
Affected
up to 1.0
What to do
Affects up to 1.0. Update Team Builder For WPBakery Page Builder(Formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Team Builder For WPBakery Page Builder(Formerly Visual Composer): Stored Cross-Site ScriptingCVE-2024-13591 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'team-builder-vc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
Affected
up to 1.0
What to do
Affects up to 1.0. Update Team Builder For WPBakery Page Builder(Formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Post SMTP: Stored Cross-Site ScriptingCVE-2025-0521 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post SMTP
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025File Uploads Addon for WooCommerce: Sensitive Information ExposureCVE-2024-13622 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments uploaded by customers.
Product
File Uploads Addon for WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update File Uploads Addon for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Sensitive Information ExposureCVE-2024-13609 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.
Product
1 Click WordPress Migration Plugin – 100% FREE for a limited time
Affected
up to 2.2
What to do
Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer): Stored Cross-Site ScriptingCVE-2024-13582 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdo_simple_pricing_table_free' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer)
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.