Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
640 results · page 3 of 13
Feb 7, 2026Post Slides: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-15491 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks
- Product
- Post Slides
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Post Slides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2026BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce: Stored Cross-Site ScriptingCVE-2025-15019 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bialty_cs_alt' post meta in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the post editor.
- Product
- BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 8, 2026WP Attractive Donations System - Easy Stripe & Paypal donations: Missing AuthorizationCVE-2025-22715 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.
- Product
- WP Attractive Donations System - Easy Stripe & Paypal donations
- Affected
- up to 1.25
- What to do
- Affects up to 1.25. Update WP Attractive Donations System - Easy Stripe & Paypal donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025YaMaps for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-13958 · WordPress plugins & themes · reported by WPScanMedium 5.9
The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- YaMaps for
- Fixed in
- 0.6.40
- What to do
- Update YaMaps for to 0.6.40 or newer.
Dec 16, 2025WP Attractive Donations System - Easy Stripe & Paypal donations: Cross-Site Request Forgery (CSRF)CVE-2025-58999 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Cross Site Request Forgery.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.
- Product
- WP Attractive Donations System - Easy Stripe & Paypal donations
- Affected
- up to 1.25
- What to do
- Affects up to 1.25. Update WP Attractive Donations System - Easy Stripe & Paypal donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2025WPS Visitor Counter: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-9116 · WordPress plugins & themes · reported by WPScanMedium 5.8
The WPS Visitor Counter WordPress plugin through 1.4.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- WPS Visitor Counter
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update WPS Visitor Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025CSV to SortTable: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-13070 · WordPress plugins & themes · reported by WPScanMedium 6.6
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
- Product
- CSV to SortTable
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update CSV to SortTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Bulk Auto Image Title Attribute: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62921 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Bulk Auto Image Title Attribute bulk-image-title-attribute allows DOM-Based XSS.This issue affects Bulk Auto Image Title Attribute: from n/a through <= 2.0.1.
- Product
- Bulk Auto Image Title Attribute
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Bulk Auto Image Title Attribute to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2025BlindMatrix e-Commerce: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-10406 · WordPress plugins & themes · reported by WPScanMedium 5.5
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.
- Product
- BlindMatrix e-Commerce
- Fixed in
- 3.1
- What to do
- Update BlindMatrix e-Commerce to 3.1 or newer.
Oct 6, 2025Responsive Lightbox & Gallery: Does not properly handle HTML tag attributes modificationsCVE-2025-9710 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.
- Product
- Responsive Lightbox & Gallery
- Fixed in
- 2.5.3
- What to do
- Update Responsive Lightbox & Gallery to 2.5.3 or newer.
Oct 1, 2025Schema & Structured Data for WP & AMP: Does not properly handles HTML tag attribute modificationsCVE-2025-9512 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.50 does not properly handles HTML tag attribute modifications, making it possible for unauthenticated attackers to conduct Stored XSS attacks via post comments.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.50
- What to do
- Update Schema & Structured Data for WP & AMP to 1.50 or newer.
Sep 22, 2025WP Attractive Donations System: Cross-Site Request Forgery (CSRF)CVE-2025-58956 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System wp-attractive-donations-system-easy-stripe-paypal-donations allows Stored XSS.This issue affects WP Attractive Donations System: from n/a through < 1.29.
- Product
- WP Attractive Donations System
- What to do
- Update WP Attractive Donations System to the newest version.
Sep 22, 2025Etsy Shop: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-9115 · WordPress plugins & themes · reported by WPScanMedium 5.6
The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- Etsy Shop
- Fixed in
- 3.0.7
- What to do
- Update Etsy Shop to 3.0.7 or newer.
Sep 12, 2025Contact Form 7 reCAPTCHA: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-8280 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- Contact Form 7 reCAPTCHA
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Contact Form 7 reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2025Ebook Store: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-8113 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
- Product
- Ebook Store
- Fixed in
- 5.8015
- What to do
- Update Ebook Store to 5.8015 or newer.
Aug 14, 2025Injection Guard: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-8046 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- Injection Guard
- Fixed in
- 1.2.8
- What to do
- Update Injection Guard to 1.2.8 or newer.
Jul 16, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47645 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.
- Product
- ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2025GeoDirectory: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-6200 · WordPress plugins & themes · reported by WPScanMedium 5.9
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GeoDirectory
- Fixed in
- 2.8.120
- What to do
- Update GeoDirectory to 2.8.120 or newer.
Jun 30, 2025WP Lightbox 2: Does not correctly sanitize the value of the title attribute of links before using themCVE-2025-3745 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
- Product
- WP Lightbox 2
- Fixed in
- 3.0.6.8
- What to do
- Update WP Lightbox 2 to 3.0.6.8 or newer.
Jun 27, 2025Firelight Lightbox: Does not sanitise and escape title attributes before outputting them in the pageCVE-2025-5035 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
- Product
- Firelight Lightbox
- Fixed in
- 2.3.16
- What to do
- Update Firelight Lightbox to 2.3.16 or newer.
Jun 20, 2025Custom Post Carousels with Owl: Uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using itCVE-2025-5125 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.
- Product
- Custom Post Carousels with Owl
- Fixed in
- 1.4.12
- What to do
- Update Custom Post Carousels with Owl to 1.4.12 or newer.
Jun 3, 2025FancyBox for: Does not escape captions and titles attributes before using them to populate galleries' caption fieldsCVE-2025-3662 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS
- Product
- FancyBox for
- Fixed in
- 3.3.6
- What to do
- Update FancyBox for to 3.3.6 or newer.
May 16, 2025Simple Lightbox: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3516 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Simple Lightbox
- Fixed in
- 2.9.4
- What to do
- Update Simple Lightbox to 2.9.4 or newer.
May 15, 2025PVN Auth Popup: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025If-So Dynamic Content Personalization: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5440 · WordPress plugins & themes · reported by WPScanMedium 5.4
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- If-So Dynamic Content Personalization
- Fixed in
- 1.8.0.3
- What to do
- Update If-So Dynamic Content Personalization to 1.8.0.3 or newer.
May 15, 2025Genesis Blocks: Does not properly escape attributes provided to some of its custom blocksCVE-2024-3901 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to conduct Stored XSS attacks.
- Product
- Genesis Blocks
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Genesis Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Twitter Bootstrap Collapse aka Accordian Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-12722 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Twitter Bootstrap Collapse aka Accordian Shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Twitter Bootstrap Collapse aka Accordian Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Planning Center Online Giving: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11502 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Planning Center Online Giving
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Planning Center Online Giving to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025JSFiddle Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10818 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JSFiddle Shortcode WordPress plugin before 1.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- JSFiddle Shortcode
- Fixed in
- 1.1.3
- What to do
- Update JSFiddle Shortcode to 1.1.3 or newer.
May 15, 2025Responsive Lightbox & Gallery: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3742 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Lightbox & Gallery
- Fixed in
- 2.5.1
- What to do
- Update Responsive Lightbox & Gallery to 2.5.1 or newer.
Apr 24, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: SQL InjectionCVE-2025-3280 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value_filter' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 10, 2025The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerableCVE-2025-2719 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in versions 1.2.8 to 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration.
- Affected
- 1.2.8 to 1.4.0
- What to do
- Affects 1.2.8 to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 4, 2025Maps: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-2279 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Maps
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025WooCommerce Cart Count Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10563 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WooCommerce Cart Count Shortcode
- Fixed in
- 1.1.0
- What to do
- Update WooCommerce Cart Count Shortcode to 1.1.0 or newer.
Feb 24, 2025Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-12308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Logo Slider
- Fixed in
- 4.6.0
- What to do
- Update Logo Slider to 4.6.0 or newer.
Feb 3, 2025Essential WP Real Estate: Does not escape generated URLs before outputting them in attributesCVE-2024-13347 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
- Product
- Essential WP Real Estate
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Essential WP Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WP MediaTagger: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-13101 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP MediaTagger
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update WP MediaTagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Bulk Me Now!: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-12708 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Bulk Me Now! WordPress plugin through 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Bulk Me Now!
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Bulk Me Now! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025tourmaster: Does not escape generated URLs before outputting them in attributesCVE-2024-12400 · WordPress plugins & themes · reported by WPScanHigh 7.1
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
- Product
- tourmaster
- Fixed in
- 5.3.5
- What to do
- Update tourmaster to 5.3.5 or newer.
Jan 18, 2025List category posts: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-9020 · WordPress plugins & themes · reported by WPScanMedium 5.4
The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- List category posts
- Fixed in
- 0.90.3
- What to do
- Update List category posts to 0.90.3 or newer.
Jan 9, 2025PostLists: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-10815 · WordPress plugins & themes · reported by WPScanMedium 4.2
The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- PostLists
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update PostLists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2025Auto iFrame: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10151 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Auto iFrame
- Fixed in
- 2.0
- What to do
- Update Auto iFrame to 2.0 or newer.
Jan 7, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22352 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.
- Product
- ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Tabs Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11606 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Tabs Shortcode
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Tabs Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025AHAthat: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-12595 · WordPress plugins & themes · reported by WPScanMedium 4.7
The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- AHAthat
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 27, 2024WP-SVG: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11644 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP-SVG
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update WP-SVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2024Serious Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11108 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Serious Slider
- Fixed in
- 1.2.7
- What to do
- Update Serious Slider to 1.2.7 or newer.
Dec 18, 2024Partners: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2024-56059 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through <= 0.2.0.
- Product
- Partners
- Affected
- up to 0.2.0
- What to do
- Affects up to 0.2.0. Update Partners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Tithe.ly Giving Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11841 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Tithe.ly Giving Button
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Tithe.ly Giving Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 25, 2024YaDisk Files: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10709 · WordPress plugins & themes · reported by WPScanMedium 6.8
The YaDisk Files WordPress plugin through 1.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- YaDisk Files
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update YaDisk Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.