Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
513 results · page 3 of 11
Feb 11, 2026BuddyHolis ListSearch: Stored Cross-Site ScriptingCVE-2026-1853 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BuddyHolis ListSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listsearch' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BuddyHolis ListSearch
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update BuddyHolis ListSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2026Better Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24938 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allows Stored XSS.This issue affects Better Search: from n/a through <= 4.2.1.
- Product
- Better Search
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 28, 2026Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization: Authentication bypassCVE-2025-14386 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the 'generate_sso_url' and 'validate_sso_token' functions in versions 2.4.4 to 2.5.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the 'nonce_token' authentication value to log in to the first Administrator's account.
- Product
- Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization
- Affected
- 2.4.4 to 2.5.12
- What to do
- Affects 2.4.4 to 2.5.12. Update Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 28, 2026Ivory Search – WordPress Search: Stored Cross-Site ScriptingCVE-2026-1053 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Ivory Search – WordPress Search
- Affected
- up to 5.5.13
- What to do
- Affects up to 5.5.13. Update Ivory Search – WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026Bayarcash WooCommerce: Missing AuthorizationCVE-2026-24606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.
- Product
- Bayarcash WooCommerce
- Affected
- up to 4.3.13
- What to do
- Affects up to 4.3.13. Update Bayarcash WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026SearchAzon: Cross-Site Request Forgery (CSRF)CVE-2026-22360 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This issue affects SearchAzon: from n/a through <= 1.4.
- Product
- SearchAzon
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update SearchAzon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Search & Go: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69005 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Search & Go search-and-go allows PHP Local File Inclusion.This issue affects Search & Go: from n/a through <= 2.8.
- Product
- Search & Go
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Search & Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP SEO Search: Cross-Site Request Forgery (CSRF)CVE-2025-67626 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Angel Costa WP SEO Search wp-seo-search allows Cross Site Request Forgery.This issue affects WP SEO Search: from n/a through <= 1.1.
- Product
- WP SEO Search
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP SEO Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Searcher for Elementor: Missing AuthorizationCVE-2025-66137 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3.
- Product
- Searcher for Elementor
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Searcher for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2026SearchWiz: Stored Cross-Site ScriptingCVE-2026-0694 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using `esc_attr()` instead of `esc_html()` when outputting post titles in search results. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in post titles that will execute whenever a user performs a search and views the search results page.
- Product
- SearchWiz
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SearchWiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 13, 2026the slider import search feature and tab parameter: WPForms 1.7.8 contains a cross-site scriptingCVE-2020-36919 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser.
- Product
- the slider import search feature and tab parameter
- Affected
- up to 1.7.8
- What to do
- Affects up to 1.7.8. Update the slider import search feature and tab parameter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jan 8, 2026eHive Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67930 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vernon Systems Limited eHive Search ehive-search allows Reflected XSS.This issue affects eHive Search: from n/a through <= 2.5.0.
- Product
- eHive Search
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update eHive Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WooCommerce Parcelas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62750 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Filipe Seabra WooCommerce Parcelas woocommerce-parcelas allows DOM-Based XSS.This issue affects WooCommerce Parcelas: from n/a through <= 1.3.5.
- Product
- WooCommerce Parcelas
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WooCommerce Parcelas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WP-EasyArchives: Cross-Site Request Forgery (CSRF)CVE-2025-49345 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through <= 3.1.2.
- Product
- WP-EasyArchives
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update WP-EasyArchives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Simple Archive Generator: Cross-Site Request Forgery (CSRF)CVE-2025-49346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
- Product
- Simple Archive Generator
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Arcane: Missing AuthorizationCVE-2025-69031 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6.
- Product
- Arcane
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update Arcane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14313 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14312 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.16.
- Product
- JetSearch
- Affected
- up to 3.5.16
- What to do
- Affects up to 3.5.16. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2025Web to SugarCRM Lead: Cross-Site Request ForgeryCVE-2025-13361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to delete custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Web to SugarCRM Lead
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Web to SugarCRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2025FiboSearch – Ajax Search for WooCommerce: Stored Cross-Site ScriptingCVE-2025-14298 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in all versions up to, and including, 1.32.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires TheGem theme (premium) to be installed with Header Builder mode enabled, and the FiboSearch "Replace search bars" option enabled for TheGem integration.
- Product
- FiboSearch – Ajax Search for WooCommerce
- Affected
- up to 1.32.0
- What to do
- Affects up to 1.32.0. Update FiboSearch – Ajax Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2025CM On Demand Search And Replace: Missing AuthorizationCVE-2025-54045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.5.
- Product
- CM On Demand Search And Replace
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2025Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated: Server-Side Request ForgeryCVE-2025-11970 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the emplibot_call_webhook_with_error() and emplibot_process_zip_data() functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2025BUKAZU Search widget: Stored Cross-Site ScriptingCVE-2025-13840 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BUKAZU Search widget
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update BUKAZU Search widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025Ivory Search: Missing AuthorizationCVE-2025-63069 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vinod Dalvi Ivory Search add-search-to-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ivory Search: from n/a through <= 5.5.12.
- Product
- Ivory Search
- Affected
- up to 5.5.12
- What to do
- Affects up to 5.5.12. Update Ivory Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025MultiParcels Shipping For WooCommerce: Missing AuthorizationCVE-2025-62995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiParcels Shipping For WooCommerce: from n/a through <= 1.30.12.
- Product
- MultiParcels Shipping For WooCommerce
- Affected
- up to 1.30.12
- What to do
- Affects up to 1.30.12. Update MultiParcels Shipping For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2025Search, Filters & Merchandising for WooCommerce: Unauthorized modification of dataCVE-2025-12091 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.67. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin.
- Product
- Search, Filters & Merchandising for WooCommerce
- Affected
- up to 3.0.67
- What to do
- Affects up to 3.0.67. Update Search, Filters & Merchandising for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 1, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-13835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.20.
- Product
- Arconix Shortcodes
- Affected
- up to 2.1.20
- What to do
- Affects up to 2.1.20. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2025Search Exclude: Unauthorized modification of dataCVE-2025-10646 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Base::get_rest_permission() method in all versions up to, and including, 2.5.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings, such as adding arbitrary posts to the search exclusion list.
- Product
- Search Exclude
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update Search Exclude to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 21, 2025Arconix Shortcodes: Missing AuthorizationCVE-2025-66085 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.
- Product
- Arconix Shortcodes
- Affected
- up to 2.1.18
- What to do
- Affects up to 2.1.18. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 10, 2025CTL Arcade Lite: Cross-Site Request ForgeryCVE-2025-11886 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'ctl_arcade_lite_page_manage_games' page. This makes it possible for unauthenticated attackers to deactivate and activate arbitrary plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- CTL Arcade Lite
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CTL Arcade Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 6, 2025Search & Go: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-62064 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through <= 2.7.
- Product
- Search & Go
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Search & Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Premmerce Product Search for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60194 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows PHP Local File Inclusion.This issue affects Premmerce Product Search for WooCommerce: from n/a through <= 2.2.4.
- Product
- Premmerce Product Search for WooCommerce
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Premmerce Product Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Barcode Scanner with Inventory & Order Manager: Path Traversal: '.../...//'CVE-2025-58972 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Path Traversal: '.../...//' vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.10.4.
- Product
- Barcode Scanner with Inventory & Order Manager
- Affected
- up to 1.10.4
- What to do
- Affects up to 1.10.4. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Ajax Search Lite: Deserialization of Untrusted DataCVE-2025-48086 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.
- Product
- Ajax Search Lite
- Affected
- up to 4.13.3
- What to do
- Affects up to 4.13.3. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Premmerce Product Search for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-64290 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Cross Site Request Forgery.This issue affects Premmerce Product Search for WooCommerce: from n/a through <= 2.2.4.
- Product
- Premmerce Product Search for WooCommerce
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Premmerce Product Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Premmerce Product Search for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64289 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Stored XSS.This issue affects Premmerce Product Search for WooCommerce: from n/a through 2.2.7.
- Product
- Premmerce Product Search for WooCommerce
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Premmerce Product Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025CloudSearch: Cross-Site Request Forgery (CSRF)CVE-2025-62962 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio CloudSearch cloud-search allows Stored XSS.This issue affects CloudSearch: from n/a through <= 3.0.0.
- Product
- CloudSearch
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update CloudSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JobSearch: Deserialization of Untrusted DataCVE-2025-62025 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.
- Product
- JobSearch
- What to do
- Update JobSearch to the newest version.
Oct 22, 2025JetSearch: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49931 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects JetSearch: from n/a through 3.5.10.
- Product
- JetSearch
- Affected
- up to 3.5.10
- What to do
- Affects up to 3.5.10. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49930 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Reflected XSS.This issue affects JetSearch: from n/a through <= 3.5.10.
- Product
- JetSearch
- Affected
- up to 3.5.10
- What to do
- Affects up to 3.5.10. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Search & Filter: Cross-Site Request Forgery (CSRF)CVE-2025-48099 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Cross-Site Request Forgery (CSRF) vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through <= 1.2.17.
- Product
- Search & Filter
- Affected
- up to 1.2.17
- What to do
- Affects up to 1.2.17. Update Search & Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2025Search & Go - Directory: Authentication BypassCVE-2025-11522 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user() function This makes it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebook login is enabled. CVE-2025-62064 is likely a duplicate of this CVE.
- Product
- Search & Go - Directory
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Search & Go - Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 2, 2025Ajax WooSearch: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9697 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Ajax WooSearch
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ajax WooSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2025Custom Searchable Data Entry System: Unauthenticated database wipingCVE-2020-36852 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazale_sds_delete_entries_table_row() function. This makes it possible for unauthenticated attackers to completely wipe database tables such as wp_users.
- Product
- Custom Searchable Data Entry System
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Custom Searchable Data Entry System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Sep 30, 2025Eulerpool Research Systems: Stored Cross-Site ScriptingCVE-2025-10128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Eulerpool Research Systems
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Eulerpool Research Systems to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 26, 2025SEO Search Permalink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60184 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. SEO Search Permalink seo-search-permalink allows Stored XSS.This issue affects SEO Search Permalink: from n/a through <= 1.0.3.
- Product
- SEO Search Permalink
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update SEO Search Permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025NGG Smart Image Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58027 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through <= 3.4.3.
- Product
- NGG Smart Image Search
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Search Atlas SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 2.5.4.
- Product
- Search Atlas SEO
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Search Atlas SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Compact Archives: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58001 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through <= 4.1.0.
- Product
- Compact Archives
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Compact Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.