Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

550new WordPress flaws this week

392,577entries in the database

40,776 results · page 257 of 816

Nov 13, 2025Survey Maker: Unauthorized access of dataCVE-2025-12891 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to view all survey submissions.
Product
Survey Maker
Affected
up to 5.1.9.4
What to do
Affects up to 5.1.9.4. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Welcart e-Commerce: Unauthorized access of dataCVE-2025-12979 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_export' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticated attackers to access configured payment credentials (ex. PayPal api secret) , as well as business contact details, mail templates, and other operational settings tied to the store.
Product
Welcart e-Commerce
Affected
up to 2.11.24
What to do
Affects up to 2.11.24. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Survey Maker: Unauthorized modification of dataCVE-2025-12892 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option.
Product
Survey Maker
Affected
up to 5.1.9.4
What to do
Affects up to 5.1.9.4. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Import any XML, CSV or Excel File to WordPress (WP All Import): Remote Code ExecutionCVE-2025-12733 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution.
Product
Import any XML, CSV or Excel File to WordPress (WP All Import)
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update Import any XML, CSV or Excel File to WordPress (WP All Import) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025SureForms: Sensitive Information ExposureCVE-2025-12536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.
Product
SureForms
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025Page Builder: Pagelayer – Drag and Drop website builder: Insecure Direct Object ReferenceCVE-2025-12366 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.5 via the pagelayer_replace_page function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace media files belonging to other users, including administrators.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025Data Tables Generator by Supsystic: Arbitrary file deletionCVE-2025-12089 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Data Tables Generator by Supsystic
Affected
up to 1.10.45
What to do
Affects up to 1.10.45. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Privilege escalationCVE-2025-11923 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
What to do
Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 20250 Day Analytics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64293 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through <= 4.0.0.
Product
0 Day Analytics
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update 0 Day Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 12, 2025Easy Email Subscription: Stored Cross-Site ScriptingCVE-2025-11994 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Email Subscription
Affected
up to 1.3
What to do
Affects up to 1.3. Update Easy Email Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Nov 12, 2025Specific Content For Mobile – Customize the mobile version without redirections: SQL InjectionCVE-2025-11454 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is vulnerable to SQL Injection via the eos_scfm_duplicate_post_as_draft() function in all versions up to, and including, 0.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with COntributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Specific Content For Mobile – Customize the mobile version without redirections
Affected
up to 0.5.5
What to do
Affects up to 0.5.5. Update Specific Content For Mobile – Customize the mobile version without redirections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Payment Plugins Braintree For WooCommerce: Authorization bypassCVE-2025-12903 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/v1/3ds/vaulted_nonce REST API endpoint in all versions up to, and including, 3.2.78. This is due to the endpoint being registered with permission_callback set to __return_true and processing user-supplied token IDs without verifying ownership or authentication. This makes it possible for unauthenticated attackers to retrieve payment method nonces for any stored payment token in the system, which can be used to create fraudulent transactions, charge customer credit cards, or attach payment methods to other subscriptions.
Product
Payment Plugins Braintree For WooCommerce
Affected
up to 3.2.78
What to do
Affects up to 3.2.78. Update Payment Plugins Braintree For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025WP Import – Ultimate CSV XML Importer for: Unauthorized access of sensitive informationCVE-2025-12732 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including, 7.33. This makes it possible for authenticated attackers, with Author-level access or higher, to extract sensitive information including OpenAI API keys configured through the plugin's admin interface.
Product
WP Import – Ultimate CSV XML Importer for
Affected
up to 7.33
What to do
Affects up to 7.33. Update WP Import – Ultimate CSV XML Importer for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025Booking Calendar | Appointment Booking | Bookit: Unauthorized modification of dataCVE-2025-12633 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to connect their Stripe account and receive payments.
Product
Booking Calendar | Appointment Booking | Bookit
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Booking Calendar | Appointment Booking | Bookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images: Unauthorized loss of dataCVE-2025-12113 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the atgai_delete_api_key() function in all versions up to, and including, 1.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the API key connected to the site.
Product
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025MembershipWorks – Membership, Events & Directory: Stored Cross-Site ScriptingCVE-2025-12018 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
MembershipWorks – Membership, Events & Directory
Affected
up to 6.14
What to do
Affects up to 6.14. Update MembershipWorks – Membership, Events & Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 12, 2025Team Members Showcase: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-11560 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins.
Product
Team Members Showcase
Fixed in
3.5.0
What to do
Update Team Members Showcase to 3.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 12, 2025Asgaros Forum: Cross-Site Request ForgeryCVE-2025-12901 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link.
Product
Asgaros Forum
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Asgaros Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 12, 2025GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Insecure Direct Object ReferenceCVE-2025-12833 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.139 via the 'post_attachment_upload' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to attach arbitrary image files to arbitrary places.
Product
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Affected
up to 2.8.139
What to do
Affects up to 2.8.139. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 12, 2025Wishlist and Save for later for Woocommerce: Insecure Direct Object ReferenceCVE-2025-12087 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the 'awwlm_remove_added_wishlist_page' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete wishlist items from other user's wishlists.
Product
Wishlist and Save for later for Woocommerce
Affected
up to 1.1.22
What to do
Affects up to 1.1.22. Update Wishlist and Save for later for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Classified Listing – AI-Powered Classified ads & Business Directory: Unauthorized modification of dataCVE-2025-12953 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "rtcl_ajax_add_listing_type", "rtcl_ajax_update_listing_type", and "rtcl_ajax_delete_listing_type" function in all versions up to, and including, 5.2.0. This makes it possible for authenticated attackers, with subscriber level access and above, to add, update, or delete listing types.
Product
Classified Listing – AI-Powered Classified ads & Business Directory
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update Classified Listing – AI-Powered Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Blocksy Companion: Authenticated arbitrary file uploadCVE-2025-12846 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Blocksy Companion
Affected
up to 2.1.19
What to do
Affects up to 2.1.19. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Missing payment verification to unauthenticated payment bypassCVE-2025-12788 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.
Product
Hydra Booking — Appointment Scheduling & Booking Calendar
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update Hydra Booking — Appointment Scheduling & Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Unauthorized booking cancellationCVE-2025-12787 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhb_meeting_form_submit_callback" function using insufficiently random values to generate booking cancellation tokens, combined with a globally shared nonce. This makes it possible for unauthenticated attackers to cancel arbitrary bookings via brute force attacks against the tfhb_meeting_form_cencel AJAX endpoint.
Product
Hydra Booking — Appointment Scheduling & Booking Calendar
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update Hydra Booking — Appointment Scheduling & Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025TNC Toolbox: Web Performance: Sensitive Information ExposureCVE-2025-12539 · WordPress plugins & themes · reported by WordfenceCritical 10
The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment.
Product
TNC Toolbox: Web Performance
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update TNC Toolbox: Web Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Nov 11, 2025age-restriction: Does not have authorisation in the age_restrictionRemoteSupportRequest functionCVE-2025-11855 · WordPress plugins & themes · reported by WPScanHigh 7.5
The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password.
Product
age-restriction
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update age-restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 11, 2025WP Go Maps (formerly WP Google Maps): Does not sanitize user input provided via an AJAX actionCVE-2025-11307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.
Product
WP Go Maps (formerly WP Google Maps)
Fixed in
9.0.48
What to do
Update WP Go Maps (formerly WP Google Maps) to 9.0.48 or newer.
Full record and what to do →NVD record wpscan.com
Nov 11, 2025Make Email Customizer for WooCommerce: Lacks proper authorization checks and option validation in its AJAX actionsCVE-2025-11237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.
Product
Make Email Customizer for WooCommerce
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Make Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 10, 2025Progress Bar Blocks for Gutenberg: Stored Cross-Site ScriptingCVE-2025-12880 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Progress Bar Blocks for Gutenberg
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Progress Bar Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025Holiday class post calendar: Remote Code ExecutionCVE-2025-12813 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.
Product
Holiday class post calendar
Affected
up to 7.1
What to do
Affects up to 7.1. Update Holiday class post calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Geopost: Stored Cross-Site ScriptingCVE-2025-12754 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Geopost
Affected
up to 1.2
What to do
Affects up to 1.2. Update Geopost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Chart Expert: Stored Cross-Site ScriptingCVE-2025-12753 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Chart Expert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmzez_chart' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Chart Expert
Affected
up to 1.0
What to do
Affects up to 1.0. Update Chart Expert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Share to Google Classroom: Stored Cross-Site ScriptingCVE-2025-12711 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Share to Google Classroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the share_to_google shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Share to Google Classroom
Affected
up to 1.0
What to do
Affects up to 1.0. Update Share to Google Classroom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Flickr Show: Stored Cross-Site ScriptingCVE-2025-12672 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flickr Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'div_height' parameter of the 'flickrshow' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flickr Show
Affected
up to 1.5
What to do
Affects up to 1.5. Update Flickr Show to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025WP-Iconics: Stored Cross-Site ScriptingCVE-2025-12671 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, and including, 0.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Iconics
Affected
up to 0.0.4
What to do
Affects up to 0.0.4. Update WP-Iconics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025WP Count Down Timer: Stored Cross-Site ScriptingCVE-2025-12668 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Count Down Timer
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Count Down Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025GitHub Gist Shortcode: Stored Cross-Site ScriptingCVE-2025-12667 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GitHub Gist Shortcode
Affected
up to 0.2
What to do
Affects up to 0.2. Update GitHub Gist Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Ninja Countdown | Fastest Countdown Builder: Unauthorized loss of dataCVE-2025-12665 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary countdowns.
Product
Ninja Countdown | Fastest Countdown Builder
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Ninja Countdown | Fastest Countdown Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025Jeba Cute forkit: Stored Cross-Site ScriptingCVE-2025-12663 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jeba Cute forkit
Affected
up to 1.0
What to do
Affects up to 1.0. Update Jeba Cute forkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Coon Google Maps: Stored Cross-Site ScriptingCVE-2025-12662 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Coon Google Maps
Affected
up to 1.0
What to do
Affects up to 1.0. Update Coon Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Preload Current Images: Stored Cross-Site ScriptingCVE-2025-12658 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Preload Current Images
Affected
up to 1.3
What to do
Affects up to 1.3. Update Preload Current Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Ungapped Widgets: Stored Cross-Site ScriptingCVE-2025-12652 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all versions up to, and including, 1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user accesses an injected page.
Product
Ungapped Widgets
Affected
up to 1
What to do
Affects up to 1. Update Ungapped Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Live Photos on: Stored Cross-Site ScriptingCVE-2025-12651 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user accesses an injected page.
Product
Live Photos on
Affected
up to 0.1
What to do
Affects up to 0.1. Update Live Photos on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Nonaki – Drag and Drop Email Template builder and Newsletter: Stored Cross-Site ScriptingCVE-2025-12644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode in all versions up to, and including, 1.0.11. This is due to insufficient input sanitization and output escaping on user supplied custom field values that are retrieved and rendered by the shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Nonaki – Drag and Drop Email Template builder and Newsletter
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Nonaki – Drag and Drop Email Template builder and Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Elastic Theme Editor: Arbitrary file uploadsCVE-2025-12637 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Elastic Theme Editor
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update Elastic Theme Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025RandomQuotr: Stored Cross-Site ScriptingCVE-2025-12632 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The RandomQuotr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
RandomQuotr
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update RandomQuotr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record it.wordpress.org wordfence.com
Nov 10, 2025Squirrels Auto Inventory: Stored Cross-Site ScriptingCVE-2025-12631 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Squirrels Auto Inventory
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Squirrels Auto Inventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025YSlider: Cross-Site Request Forgery to Stored Cross-Site ScriptingCVE-2025-12590 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses an injected page.
Product
YSlider
Affected
up to 1.1
What to do
Affects up to 1.1. Update YSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025WP-Walla: Cross-Site Request Forgery to Stored Cross-Site ScriptingCVE-2025-12589 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
WP-Walla
Affected
up to 0.5.3.5
What to do
Affects up to 0.5.3.5. Update WP-Walla to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org developer.wordpress.org
Nov 10, 2025USB Qr Code Scanner For Woocommerce: Cross-Site Request ForgeryCVE-2025-12588 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
USB Qr Code Scanner For Woocommerce
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update USB Qr Code Scanner For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.