Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
409 results · page 3 of 9
Jun 15, 2026Form Builder CP: Does not properly sanitize a form configuration value before storing it and using itCVE-2026-9278 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Builder CP WordPress plugin before 1.2.47 does not properly sanitize a form configuration value before storing it and using it as part of a client-side script execution, allowing authenticated users with Editor-level access and above to perform Stored Cross-Site Scripting attacks against any visitor of a page rendering the affected form, even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).
- Product
- Form Builder CP
- Fixed in
- 1.2.47
- What to do
- Update Form Builder CP to 1.2.47 or newer.
Jun 13, 2026Store Locator: Does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1CVE-2026-9061 · WordPress plugins & themes · reported by WPScanLow 3.5
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).
- Product
- Store Locator
- Fixed in
- 1.6.9
- What to do
- Update Store Locator to 1.6.9 or newer.
Jun 10, 2026Store Locator: Does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1CVE-2026-9060 · WordPress plugins & themes · reported by WPScanLow 3.5
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network where the super admin visits the page).
- Product
- Store Locator
- Fixed in
- 1.6.6
- What to do
- Update Store Locator to 1.6.6 or newer.
Jun 10, 2026Anti-Spam by CleanTalk. Spam protection: Does not properly sanitize content within a custom shortcode used in its email-encoding featureCVE-2026-8071 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.
- Product
- Anti-Spam by CleanTalk. Spam protection
- Fixed in
- 6.79
- What to do
- Update Anti-Spam by CleanTalk. Spam protection to 6.79 or newer.
May 27, 2026EventPress: Does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the responseCVE-2026-6268 · WordPress plugins & themes · reported by WPScanHigh 7.1
The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.
- Product
- EventPress
- Fixed in
- 22.2
- What to do
- Update EventPress to 22.2 or newer.
May 18, 2026WP Maps: Does not properly sanitize a parameter before using it in a file pathCVE-2026-6381 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks.
- Product
- WP Maps
- Fixed in
- 4.9.3
- What to do
- Update WP Maps to 4.9.3 or newer.
May 18, 2026WP Photo Album Plus: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-6379 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- WP Photo Album Plus
- Fixed in
- 9.1.11.001
- What to do
- Update WP Photo Album Plus to 9.1.11.001 or newer.
May 11, 2026Custom css-js-php: Does not properly sanitize user input before using it in a SQL queryCVE-2026-6433 · WordPress plugins & themes · reported by WPScanHigh 7.3
The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.
- Product
- Custom css-js-php
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Custom css-js-php to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2026OttoKit: All-in-One Automation Platform: Does not properly sanitize user input before using it in a SQL statementCVE-2026-4935 · WordPress plugins & themes · reported by WPScanHigh 8.6
The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
- Product
- OttoKit: All-in-One Automation Platform
- Fixed in
- 1.1.23
- What to do
- Update OttoKit: All-in-One Automation Platform to 1.1.23 or newer.
Apr 23, 2026reCaptcha by WebDesignBy: Does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() functionCVE-2026-4512 · WordPress plugins & themes · reported by WPScanLow 3.5
The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() function. This allows administrators on multisite installations (who do not have the unfiltered_html capability) to inject arbitrary JavaScript that executes for all visitors to the WordPress login page.
- Product
- reCaptcha by WebDesignBy
- Fixed in
- 2.0
- What to do
- Update reCaptcha by WebDesignBy to 2.0 or newer.
Apr 13, 2026Product Filter for WooCommerce by WBW: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-3830 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- Product Filter for WooCommerce by WBW
- Fixed in
- 3.1.3
- What to do
- Update Product Filter for WooCommerce by WBW to 3.1.3 or newer.
Jan 26, 2026Recipe Card Blocks Lite: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-14973 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.
- Product
- Recipe Card Blocks Lite
- Fixed in
- 3.4.13
- What to do
- Update Recipe Card Blocks Lite to 3.4.13 or newer.
Jan 7, 2026Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium: Do not sanitize and escape a parameter before using it in a SQL statementCVE-2025-14719 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowing contributor and above roles to perform SQL injection attacks
- Product
- Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium
- Fixed in
- 4.26.0
- What to do
- Update Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium to 4.26.0 or newer.
Jan 5, 2026Team: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-14124 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Team
- Fixed in
- 5.0.11
- What to do
- Update Team to 5.0.11 or newer.
Dec 29, 2025Plugin Organizer: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-13417 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers to perform SQL injection attacks.
- Product
- Plugin Organizer
- Fixed in
- 10.2.4
- What to do
- Update Plugin Organizer to 10.2.4 or newer.
Dec 15, 2025URL Shortify: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-12684 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins.
- Product
- URL Shortify
- Fixed in
- 1.11.3
- What to do
- Update URL Shortify to 1.11.3 or newer.
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13073 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- HandL UTM Grabber / Tracker
- Fixed in
- 2.8.1
- What to do
- Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Dec 10, 2025HandL UTM Grabber / Tracker: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-13072 · WordPress plugins & themes · reported by WPScanHigh 7.1
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- HandL UTM Grabber / Tracker
- Fixed in
- 2.8.1
- What to do
- Update HandL UTM Grabber / Tracker to 2.8.1 or newer.
Dec 9, 2025WPeMatico RSS Feed Fetcher: Does not sanitize and escape some of its settingsCVE-2025-13031 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.13
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.13 or newer.
Dec 2, 2025donation: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-13001 · WordPress plugins & themes · reported by WPScanMedium 4.1
The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks
- Product
- donation
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2025attention-bar: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-12502 · WordPress plugins & themes · reported by WPScanMedium 6.8
The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users such as administrator to perform SQL injection attacks
- Product
- attention-bar
- Affected
- up to 0.7.2.1
- What to do
- Affects up to 0.7.2.1. Update attention-bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2025Team Members Showcase: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-11560 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins.
- Product
- Team Members Showcase
- Fixed in
- 3.5.0
- What to do
- Update Team Members Showcase to 3.5.0 or newer.
Nov 11, 2025WP Go Maps (formerly WP Google Maps): Does not sanitize user input provided via an AJAX actionCVE-2025-11307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.
- Product
- WP Go Maps (formerly WP Google Maps)
- Fixed in
- 9.0.48
- What to do
- Update WP Go Maps (formerly WP Google Maps) to 9.0.48 or newer.
Nov 5, 2025FunnelKit: Does not sanitize user input before echoing it back in some of its checkout-related AJAX actionsCVE-2025-10567 · WordPress plugins & themes · reported by WPScanMedium 6.3
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.
- Product
- FunnelKit
- Fixed in
- 3.12.0.1
- What to do
- Update FunnelKit to 3.12.0.1 or newer.
Oct 24, 2025Jeg Kit for Elementor: Does not sanitize SVG file contentsCVE-2025-9978 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.
- Product
- Jeg Kit for Elementor
- Fixed in
- 2.7.0
- What to do
- Update Jeg Kit for Elementor to 2.7.0 or newer.
Oct 13, 2025Plus Addons for Elementor: Does not sanitize SVG file contentsCVE-2025-9698 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
- Product
- Plus Addons for Elementor
- Fixed in
- 6.3.16
- What to do
- Update Plus Addons for Elementor to 6.3.16 or newer.
Oct 8, 2025Find Me On: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-10635 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks
- Product
- Find Me On
- Affected
- up to 2.0.9.1
- What to do
- Affects up to 2.0.9.1. Update Find Me On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2025Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder): Does not sanitize SVG file contentsCVE-2025-9703 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
- Product
- Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)
- Fixed in
- 2.5.0
- What to do
- Update Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) to 2.5.0 or newer.
Jun 30, 2025WP Lightbox 2: Does not correctly sanitize the value of the title attribute of links before using themCVE-2025-3745 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
- Product
- WP Lightbox 2
- Fixed in
- 3.0.6.8
- What to do
- Update WP Lightbox 2 to 3.0.6.8 or newer.
May 15, 2025WP-PManager: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2248 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- WP-PManager
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025FunnelKit: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- FunnelKit
- Fixed in
- 3.10.2
- What to do
- Update FunnelKit to 3.10.2 or newer.
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9879 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Melapress File Monitor
- Fixed in
- 2.1.1
- What to do
- Update Melapress File Monitor to 2.1.1 or newer.
May 15, 2025Auto Affiliate Links: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Auto Affiliate Links
- Fixed in
- 6.4.7
- What to do
- Update Auto Affiliate Links to 6.4.7 or newer.
May 15, 2025Taskbuilder: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9831 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Taskbuilder
- Fixed in
- 3.0.9
- What to do
- Update Taskbuilder to 3.0.9 or newer.
May 15, 2025Quiz Maker: Does not sanitize and escape some of its settingsCVE-2024-8617 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Quiz Maker
- Fixed in
- 6.5.9.9
- What to do
- Update Quiz Maker to 6.5.9.9 or newer.
May 15, 2025webtoffee-gdpr-cookie-consent: Does not properly sanitize and escape the IP headersCVE-2024-8397 · WordPress plugins & themes · reported by WPScanMedium 5.4
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.
- Product
- webtoffee-gdpr-cookie-consent
- Fixed in
- 2.6.1
- What to do
- Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
May 15, 2025Advance Post Prefix: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12735 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above to perform SQL injection attacks
- Product
- Advance Post Prefix
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Advance Post Prefix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Connexion Logs: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Connexion Logs
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Connexion Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025AHAthat: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11269 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks.
- Product
- AHAthat
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025JSP Store Locator: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11267 · WordPress plugins & themes · reported by WPScanHigh 8.8
The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing user with Contributor to perform SQL injection attacks.
- Product
- JSP Store Locator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update JSP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Nokaut Offers Box: Does not sanitize and escape some of its settingsCVE-2024-10632 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Nokaut Offers Box
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Nokaut Offers Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Social Media Share Buttons & Social Sharing Icons: Does not sanitize and escape some of its settingsCVE-2024-10362 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Media Share Buttons & Social Sharing Icons
- Fixed in
- 2.9.1
- What to do
- Update Social Media Share Buttons & Social Sharing Icons to 2.9.1 or newer.
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10009 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Melapress File Monitor
- Fixed in
- 2.1.0
- What to do
- Update Melapress File Monitor to 2.1.0 or newer.
May 15, 2025illi Link Party!: Does not sanitize and escape some parametersCVE-2023-7230 · WordPress plugins & themes · reported by WPScanMedium 6.1
The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Add SVG Support for Media Uploader | inventivo: Does not sanitize uploaded SVG filesCVE-2023-7088 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Add SVG Support for Media Uploader | inventivo
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Add SVG Support for Media Uploader | inventivo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025SVG Uploads Support: Does not sanitize uploaded SVG filesCVE-2023-7086 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- SVG Uploads Support
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update SVG Uploads Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Allow SVG: Does not sanitize uploaded SVG filesCVE-2023-6541 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Allow SVG
- Fixed in
- 1.2.0
- What to do
- Update Allow SVG to 1.2.0 or newer.
Apr 1, 2025Gutentor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-1986 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Gutentor
- Fixed in
- 3.4.7
- What to do
- Update Gutentor to 3.4.7 or newer.
Mar 26, 2025wp-svg-upload: Does not sanitize SVG file contentsCVE-2024-11847 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
- Product
- wp-svg-upload
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update wp-svg-upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2025WP-Recall: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9770 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- WP-Recall
- Fixed in
- 16.26.12
- What to do
- Update WP-Recall to 16.26.12 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.