Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

487 results · page 3 of 10

May 12, 2026Advanced Social Media Icons: Stored Cross-Site ScriptingCVE-2026-7659 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Social Media Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `social` shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Social Media Icons
Affected
up to 1.2
What to do
Affects up to 1.2. Update Advanced Social Media Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2026MaxiBlocks Builder: Arbitrary media file deletionCVE-2026-2028 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxi_remove_custom_image_size' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files in the wp-content/uploads directory, including files uploaded by other users and administrators.
Product
MaxiBlocks Builder
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update MaxiBlocks Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Apr 8, 2026Blog2Social: Social Media Auto Post & Scheduler: Authorization bypass through user-controlled keyCVE-2026-4330 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users' scheduled social media posts.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 8.8.3
What to do
Affects up to 8.8.3. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2026Simple Social Media Share Buttons: Cross-Site Request Forgery (CSRF)CVE-2026-34904 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media Share Buttons allows Cross Site Request Forgery.This issue affects Simple Social Media Share Buttons: from n/a through 6.2.0.
Product
Simple Social Media Share Buttons
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Simple Social Media Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 6, 2026Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-34897 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.34.
Product
Media LIbrary Assistant
Affected
up to 3.34
What to do
Affects up to 3.34. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 6, 2026Media LIbrary Assistant: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-34885 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.34.
Product
Media LIbrary Assistant
Affected
up to 3.34
What to do
Affects up to 3.34. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2026Listeo Core: Unauthenticated arbitrary media uploadCVE-2025-14938 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeo_core_handle_dropped_media" function. This is due to missing authorization and capability checks on the AJAX endpoint handling file uploads. This makes it possible for unauthenticated attackers to upload arbitrary media to the site's media library, without achieving direct code execution.
Product
Listeo Core
Affected
up to 2.0.27
What to do
Affects up to 2.0.27. Update Listeo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.purethemes.net wordfence.com
Mar 26, 2026Blog2Social: Social Media Auto Post & Scheduler: Unauthorized data lossCVE-2026-4331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags() function only verifying that the user has the 'read' capability and a valid b2s_security_nonce, both of which are available to Subscriber-level users, as the plugin grants 'blog2social_access' capability to all roles upon activation, allowing them to access the plugin's admin pages where the nonce is output. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all _b2s_post_meta records from the wp_postmeta table, permanently removing all custom social media meta tags for every post on the site.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 8.8.2
What to do
Affects up to 8.8.2. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2026Info Cards – Add Text and Media in Card Layouts: Stored Cross-Site ScriptingCVE-2026-4120 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the lack of javascript: protocol filtering. The block's render.php passes all attributes as JSON to the frontend via a data-attributes HTML attribute using esc_attr(wp_json_encode()), which prevents HTML attribute injection but does not validate URL protocols within the JSON data. The client-side view.js then renders the btnUrl value directly as an href attribute on anchor elements without any protocol sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject javascript: URLs that execute arbitrary web scripts when a user clicks the rendered button link.
Product
Info Cards – Add Text and Media in Card Layouts
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Info Cards – Add Text and Media in Card Layouts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2026Add Custom Fields to Media: Cross-Site Request ForgeryCVE-2026-4068 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing nonce validation on the field deletion functionality in the admin display template. The plugin properly validates a nonce for the 'add field' operation (line 24-36), but the 'delete field' operation (lines 38-49) processes the $_GET['delete'] parameter and calls update_option() without any nonce verification. This makes it possible for unauthenticated attackers to delete arbitrary custom media fields via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Add Custom Fields to Media
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Add Custom Fields to Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026Media LIbrary Assistant: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32399 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.32.
Product
Media LIbrary Assistant
Affected
up to 3.32
What to do
Affects up to 3.32. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Travel Diaries: Missing AuthorizationCVE-2026-32375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Travel Diaries travel-diaries allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Diaries: from n/a through <= 1.2.4.
Product
Travel Diaries
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Travel Diaries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Modal Dialog: Improper Control of Generation of Code ('Code Injection')CVE-2026-32367 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Yannick Lefebvre Modal Dialog modal-dialog allows Remote Code Inclusion.This issue affects Modal Dialog: from n/a through <= 3.5.16.
Product
Modal Dialog
Affected
up to 3.5.16
What to do
Affects up to 3.5.16. Update Modal Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 7, 2026LotekMedia Popup Form: Stored Cross-Site ScriptingCVE-2026-2420 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The LotekMedia Popup Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the frontend of the site where the popup is displayed.
Product
LotekMedia Popup Form
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update LotekMedia Popup Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2026Media Library Alt Text Editor: Stored Cross-Site ScriptingCVE-2026-1820 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Alt Text Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bvmalt_sc_div_update_alt_text' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Media Library Alt Text Editor
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Media Library Alt Text Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2026DA Media GigList: Stored Cross-Site ScriptingCVE-2026-1805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DA Media GigList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's damedia_giglist shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DA Media GigList
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update DA Media GigList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2026Guardian News Feed: Cross-Site Request ForgeryCVE-2026-1087 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Guardian News Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the Guardian API key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Guardian News Feed
Affected
up to 1.2
What to do
Affects up to 1.2. Update Guardian News Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Media Library Assistant: Unauthorized modification of dataCVE-2026-3072 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_fields_action() function in all versions up to, and including, 3.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify taxonomy terms on arbitrary attachments.
Product
Media Library Assistant
Affected
up to 3.33
What to do
Affects up to 3.33. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 4, 2026Enable Media Replace: Unauthorized modification of dataCVE-2026-2732 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Enable Media Replace plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'RemoveBackGroundViewController::load' function in all versions up to, and including, 4.1.7. This makes it possible for authenticated attackers, with Author-level access and above, to replace any attachment with a removed background attachment.
Product
Enable Media Replace
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update Enable Media Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 2, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Blind SQL InjectionCVE-2026-3180 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability's ’cgLostPasswordEmail’ parameter was patched in version 28.1.4, and the ’cgl_mail’ parameter was patched in version 28.1.5.
Product
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Affected
up to 28.1.4
What to do
Affects up to 28.1.4. Update Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2026Lorem Ipsum | Books & Media Store: Deserialization of Untrusted DataCVE-2025-69405 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.
Product
Lorem Ipsum | Books & Media Store
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update Lorem Ipsum | Books & Media Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Diamond: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69391 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Diamond diamond allows Reflected XSS.This issue affects Diamond: from n/a through <= 2.4.8.
Product
Diamond
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Diamond to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Export Media URLs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68037 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atlas Gondal Export Media URLs export-media-urls allows Reflected XSS.This issue affects Export Media URLs: from n/a through <= 2.2.
Product
Export Media URLs
Affected
up to 2.2
What to do
Affects up to 2.2. Update Export Media URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026rtMedia for WordPress, BuddyPress and bbPress: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25325 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Retrieve Embedded Sensitive Data.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through <= 4.7.8.
Product
rtMedia for WordPress, BuddyPress and bbPress
Affected
up to 4.7.8
What to do
Affects up to 4.7.8. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Media Search Enhanced: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-23805 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yoren Chang Media Search Enhanced media-search-enhanced allows SQL Injection.This issue affects Media Search Enhanced: from n/a through <= 0.9.1.
Product
Media Search Enhanced
Affected
up to 0.9.1
What to do
Affects up to 0.9.1. Update Media Search Enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2026Blog2Social: Social Media Auto Post & Scheduler: Unauthorized modification of dataCVE-2026-1942 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b2s_curation_draft AJAX action in all versions up to, and including, 8.7.4. The curationDraft() function only verifies current_user_can('read') without checking whether the user has edit_post permission for the target post. Combined with the plugin granting UI access and nonce exposure to all roles, this makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the title and content of arbitrary posts and pages by supplying a target post ID via the 'b2s-draft-id' parameter.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 8.7.4
What to do
Affects up to 8.7.4. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026Media Library Folders: Insecure Direct Object ReferenceCVE-2026-2312 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Media Library Folders plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 8.3.6 via the delete_maxgalleria_media() and maxgalleria_rename_image() functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to delete or rename attachments owned by other users (including administrators). The rename flow also deletes all postmeta for the target attachment, causing data loss.
Product
Media Library Folders
Affected
up to 8.3.6
What to do
Affects up to 8.3.6. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2026Converter for Media – Optimize images | Convert WebP & AVIF: Server-Side Request ForgeryCVE-2026-1356 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load_image_source function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Converter for Media – Optimize images | Convert WebP & AVIF
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update Converter for Media – Optimize images | Convert WebP & AVIF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 11, 2026WPlyr Media Block: Stored Cross-Site ScriptingCVE-2026-0724 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPlyr Media Block
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update WPlyr Media Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Vzaar Media Management: Reflected Cross-Site ScriptingCVE-2026-1391 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Vzaar Media Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on the $_SERVER['PHP_SELF'] variable. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Vzaar Media Management
Affected
up to 1.2
What to do
Affects up to 1.2. Update Vzaar Media Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026Alchemist Ajax Upload: Unauthorized media file deletionCVE-2025-14629 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'delete_file' function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments.
Product
Alchemist Ajax Upload
Affected
up to 1.1
What to do
Affects up to 1.1. Update Alchemist Ajax Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026Media Library File Size: Missing AuthorizationCVE-2026-24569 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sully Media Library File Size media-library-file-size allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Library File Size: from n/a through <= 1.6.7.
Product
Media Library File Size
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update Media Library File Size to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 10, 2026Blog2Social: Social Media Auto Post & Scheduler: Sensitive Information ExposureCVE-2025-14943 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. This is due to a misconfigured authorization check on the 'getShipItemFullText' function which only verifies that a user has the 'read' capability (Subscriber-level) and a valid nonce, but fails to verify whether the user has permission to access the specific post being requested. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract data from password-protected, private, or draft posts.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 8.7.2
What to do
Affects up to 8.7.2. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 8, 2026MediaPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22519 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This issue affects MediaPress: from n/a through <= 1.6.2.
Product
MediaPress
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update MediaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Easy Media Download: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-69169 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noor Alam Easy Media Download easy-media-download allows Reflection Injection.This issue affects Easy Media Download: from n/a through <= 1.1.11.
Product
Easy Media Download
Affected
up to 1.1.11
What to do
Affects up to 1.1.11. Update Easy Media Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unauthorized Arbitrary Media ReplacementCVE-2025-12640 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library.
Product
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026External Media: Server-Side Request Forgery (SSRF)CVE-2025-49335 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in minnur External Media external-media allows Server Side Request Forgery.This issue affects External Media: from n/a through <= 1.0.36.
Product
External Media
Affected
up to 1.0.36
What to do
Affects up to 1.0.36. Update External Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026MediaPress: Stored Cross-Site ScriptingCVE-2025-14552 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MediaPress
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update MediaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 5, 2026Media File Renamer: Unrestricted Upload of File with Dangerous TypeCVE-2023-50897 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Meow Apps Media File Renamer allows Using Malicious Files.This issue affects Media File Renamer: from n/a through 5.7.7.
Product
Media File Renamer
Affected
up to 5.7.7
What to do
Affects up to 5.7.7. Update Media File Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vdp.patchstack.com
Dec 31, 2025Mediabay - WordPress Media Library Folders: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28949 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL Injection.This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.
Product
Mediabay - WordPress Media Library Folders
Affected
up to 1.4
What to do
Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Gmedia Photo Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-63014 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Cross Site Request Forgery.This issue affects Gmedia Photo Gallery: from n/a through <= 1.25.0.
Product
Gmedia Photo Gallery
Affected
up to 1.25.0
What to do
Affects up to 1.25.0. Update Gmedia Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Download Media Library: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62114 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in marcelotorres Download Media Library download-media-library allows Retrieve Embedded Sensitive Data.This issue affects Download Media Library: from n/a through <= 0.2.1.
Product
Download Media Library
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Download Media Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 17, 2025Converter for Media – Optimize images | Convert WebP & AVIF: Unauthorized modification of dataCVE-2025-13750 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `/webp-converter/v1/regenerate-attachment` REST endpoint in all versions up to, and including, 6.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete optimized WebP/AVIF variants for arbitrary attachments.
Product
Converter for Media – Optimize images | Convert WebP & AVIF
Affected
up to 6.3.2
What to do
Affects up to 6.3.2. Update Converter for Media – Optimize images | Convert WebP & AVIF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2025Fix Media Library: Insertion of Sensitive Information Into Sent DataCVE-2025-66126 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in wowpress.host Fix Media Library wow-media-library-fix allows Retrieve Embedded Sensitive Data.This issue affects Fix Media Library: from n/a through <= 2.0.
Product
Fix Media Library
Affected
up to 2.0
What to do
Affects up to 2.0. Update Fix Media Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 15, 2025FileBird – WordPress Media Library Folders & File Manager: Missing authorizationCVE-2025-12900 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author level access and above, to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025rtMedia for WordPress, BuddyPress and bbPress: To Information DisclosureCVE-2025-9218 · WordPress plugins & themes · reported by WordfenceLow 3.7
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.
Product
rtMedia for WordPress, BuddyPress and bbPress
Affected
4.7.0 to 4.7.3
What to do
Affects 4.7.0 to 4.7.3. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 13, 2025MediaCommander – Bring Folders to Media, Posts, and Pages: Unauthorized data deletionCVE-2025-14508 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files` capability check (Author level) for a destructive operation that can delete all folders. This makes it possible for authenticated attackers, with Author-level access and above, to delete all folder organization data created by Administrators and other users.
Product
MediaCommander – Bring Folders to Media, Posts, and Pages
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update MediaCommander – Bring Folders to Media, Posts, and Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025Social Media Auto Publish: Reflected Cross-Site ScriptingCVE-2025-12076 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage parameter in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Social Media Auto Publish
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update Social Media Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2025URL Media Uploader: Unauthorized safe file uploadsCVE-2025-14045 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload safe media files.
Product
URL Media Uploader
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update URL Media Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 11, 2025Foxtool All-in-One: Contact chat button, Custom login, Media optimize images: Cross-Site Request ForgeryCVE-2025-13408 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the foxtool_login_google() function. This makes it possible for unauthenticated attackers to establish an OAuth Connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Foxtool All-in-One: Contact chat button, Custom login, Media optimize images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.