Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
326 results · page 3 of 7
Oct 22, 2025Meta Tag Manager: Does not restrictCVE-2025-5983 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags.
- Product
- Meta Tag Manager
- Fixed in
- 3.3
- What to do
- Update Meta Tag Manager to 3.3 or newer.
Sep 26, 2025Simple Meta Tags: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60142 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaganLev Simple Meta Tags simple-meta-tags allows DOM-Based XSS.This issue affects Simple Meta Tags: from n/a through <= 1.5.
- Product
- Simple Meta Tags
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Simple Meta Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2025Robcore Netatmo: SQL InjectionCVE-2025-10652 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Robcore Netatmo plugin for WordPress is vulnerable to SQL Injection via the ‘module_id’ attribute of the robcore-netatmo shortcode in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Robcore Netatmo
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Robcore Netatmo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2025User Meta – User Profile Builder and User management: Arbitrary file deletionCVE-2025-9693 · WordPress plugins & themes · reported by WordfenceHigh 8
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- User Meta – User Profile Builder and User management
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update User Meta – User Profile Builder and User management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 3, 2025RumbleTalk Live Group Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58626 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Stored XSS.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.3.5.
- Product
- RumbleTalk Live Group Chat
- Affected
- up to 6.3.5
- What to do
- Affects up to 6.3.5. Update RumbleTalk Live Group Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 15, 2025Add User Meta: Cross-Site Request ForgeryCVE-2025-7688 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Add User Meta plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the 'add-user-meta' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Add User Meta
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Add User Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 14, 2025Slider, Gallery, and Carousel by MetaSlider: Stored Cross-Site ScriptingCVE-2025-5337 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ parameter in all versions up to, and including, 3.98.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Slider, Gallery, and Carousel by MetaSlider
- Affected
- up to 3.98.0
- What to do
- Affects up to 3.98.0. Update Slider, Gallery, and Carousel by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2025MetalpriceAPI: Improper Control of Generation of Code ('Code Injection')CVE-2025-48140 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through <= 1.1.4.
- Product
- MetalpriceAPI
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update MetalpriceAPI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Pinterest Verify Meta Tag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30941 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marvie Pons Pinterest Verify Meta Tag pinterest-verify-meta-tag allows Stored XSS.This issue affects Pinterest Verify Meta Tag: from n/a through <= 1.3.
- Product
- Pinterest Verify Meta Tag
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Pinterest Verify Meta Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 31, 2025WP-GeoMeta: Privilege EscalationCVE-2025-4103 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function in versions 0.3.4 to 0.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
- Product
- WP-GeoMeta
- Affected
- 0.3.4 to 0.3.5
- What to do
- Affects 0.3.4 to 0.3.5. Update WP-GeoMeta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 23, 2025User Meta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khaled User Meta user-meta allows Reflected XSS.This issue affects User Meta: from n/a through <= 3.1.2.
- Product
- User Meta
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update User Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Meta Keywords & Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-46454 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in svil4ok Meta Keywords & Description wp-meta-keywords-meta-description allows PHP Local File Inclusion.This issue affects Meta Keywords & Description: from n/a through <= 0.8.
- Product
- Meta Keywords & Description
- Affected
- up to 0.8
- What to do
- Affects up to 0.8. Update Meta Keywords & Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025User Profile Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-48340 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through <= 1.02.
- Product
- User Profile Meta Manager
- Affected
- up to 1.02
- What to do
- Affects up to 1.02. Update User Profile Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025LSD Custom taxonomy and category meta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46502 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Matthee LSD Custom taxonomy and category meta custom-taxonomy-category-and-term-fields allows Cross Site Request Forgery.This issue affects LSD Custom taxonomy and category meta: from n/a through <= 1.3.2.
- Product
- LSD Custom taxonomy and category meta
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update LSD Custom taxonomy and category meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Simple Post Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-32556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simple Post Meta Manager: from n/a through <= 1.0.9.
- Product
- Simple Post Meta Manager
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Simple Post Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Seo Meta Tags: Cross-Site Request Forgery (CSRF)CVE-2025-31023 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Purab Seo Meta Tags seo-meta-tags allows Cross Site Request Forgery.This issue affects Seo Meta Tags: from n/a through <= 1.4.
- Product
- Seo Meta Tags
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Seo Meta Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Export All Post Meta: Missing AuthorizationCVE-2025-31856 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in brainvireinfo Export All Post Meta export-all-post-meta allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export All Post Meta: from n/a through <= 1.2.1.
- Product
- Export All Post Meta
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Export All Post Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Secret Meta: Cross-Site Request Forgery (CSRF)CVE-2025-25086 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through <= 1.2.1.
- Product
- Secret Meta
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Secret Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Display Post Meta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26575 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Maurer Display Post Meta display-post-meta allows Reflected XSS.This issue affects Display Post Meta: from n/a through <= 2.4.4.
- Product
- Display Post Meta
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Display Post Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025LH OGP Meta: Cross-Site Request Forgery (CSRF)CVE-2025-30587 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <= 1.73.
- Product
- LH OGP Meta
- Affected
- up to 1.73
- What to do
- Affects up to 1.73. Update LH OGP Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its settingsCVE-2025-1203 · WordPress plugins & themes · reported by WPScanLow 3.5
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Slider, Gallery, and Carousel by MetaSlider
- Fixed in
- 3.95.0
- What to do
- Update Slider, Gallery, and Carousel by MetaSlider to 3.95.0 or newer.
Mar 24, 2025Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its settingsCVE-2025-1062 · WordPress plugins & themes · reported by WPScanLow 3.5
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Slider, Gallery, and Carousel by MetaSlider
- Fixed in
- 3.95.0
- What to do
- Update Slider, Gallery, and Carousel by MetaSlider to 3.95.0 or newer.
Mar 13, 2025WP e-Customers Beta: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13885 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP e-Customers Beta
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update WP e-Customers Beta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2025Post Meta Data Manager: Multisite privilege escalationCVE-2024-13835 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying the existence of a multisite installation prior to allowing user meta to be added/modified. This makes it possible for authenticated attackers, with Administrator-level access and above, to gain elevated privileges on subsites that would otherwise be inaccessible.
- Product
- Post Meta Data Manager
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Mar 3, 2025Authors Autocomplete Meta Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25169 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autocomplete-meta-box allows Reflected XSS.This issue affects Authors Autocomplete Meta Box: from n/a through <= 1.2.
- Product
- Authors Autocomplete Meta Box
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Authors Autocomplete Meta Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Meta Accelerator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25164 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuichiro ABE Meta Accelerator meta-accelerator allows Reflected XSS.This issue affects Meta Accelerator: from n/a through <= 1.0.4.
- Product
- Meta Accelerator
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Meta Accelerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Visitor Details: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25132 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ravi Singh Visitor Details visitors-details allows Stored XSS.This issue affects Visitor Details: from n/a through <= 1.0.1.
- Product
- Visitor Details
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Visitor Details to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025UniTimetable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25084 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antrouss UniTimetable unitimetable allows Stored XSS.This issue affects UniTimetable: from n/a through <= 1.1.
- Product
- UniTimetable
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update UniTimetable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 22, 2025Responsive Slider by MetaSlider: Deserialization of Untrusted DataCVE-2025-26763 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.94.0.
- Product
- Responsive Slider by MetaSlider
- Affected
- up to 3.94.0
- What to do
- Affects up to 3.94.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025ImageMeta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23845 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta imagemeta allows Reflected XSS.This issue affects ImageMeta: from n/a through <= 1.1.2.
- Product
- ImageMeta
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update ImageMeta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Monetag Official: Missing AuthorizationCVE-2024-52500 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
- Product
- Monetag Official
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Monetag Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025Global Meta Keyword & Description: Cross-Site Request Forgery (CSRF)CVE-2025-26550 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kunal Shivale Global Meta Keyword & Description global-meta-keyword-and-description allows Stored XSS.This issue affects Global Meta Keyword & Description: from n/a through <= 2.3.
- Product
- Global Meta Keyword & Description
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Global Meta Keyword & Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Meta Tag Manager: Missing AuthorizationCVE-2025-22260 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marcus (aka @msykes) Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through <= 3.1.
- Product
- Meta Tag Manager
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Meta Tag Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Post Meta: Cross-Site Request Forgery (CSRF)CVE-2025-24549 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mahbubur Rahman Post Meta post-meta allows Reflected XSS.This issue affects Post Meta: from n/a through <= 1.0.9.
- Product
- Post Meta
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Post Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Tracking Code Manager: Does not sanitise and escape some of its metabox settingsCVE-2024-10309 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Tracking Code Manager
- Fixed in
- 2.4.0
- What to do
- Update Tracking Code Manager to 2.4.0 or newer.
Jan 27, 2025Responsive Slider by MetaSlider: Cross-Site Request Forgery (CSRF)CVE-2025-24533 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Cross Site Request Forgery.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.92.0.
- Product
- Responsive Slider by MetaSlider
- Affected
- up to 3.92.0
- What to do
- Affects up to 3.92.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025JSM Show Post Metadata: Missing AuthorizationCVE-2025-24589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through <= 4.6.0.
- Product
- JSM Show Post Metadata
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update JSM Show Post Metadata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Precious Metals Charts and Widgets for: Stored Cross-Site ScriptingCVE-2024-13572 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Precious Metals Charts and Widgets for
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Precious Metals Charts and Widgets for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 23, 2025MDTF – Meta Data and Taxonomies Filter: Stored Cross-Site ScriptingCVE-2024-13340 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdf_results_by_ajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MDTF – Meta Data and Taxonomies Filter
- Affected
- up to 1.3.3.6
- What to do
- Affects up to 1.3.3.6. Update MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2025Metaphor Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23816 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Metaphor Widgets allows Stored XSS. This issue affects Metaphor Widgets: from n/a through 2.4.
- Product
- Metaphor Widgets
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Metaphor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2025MDTF – Meta Data and Taxonomies Filter: SQL InjectionCVE-2024-12030 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdf_value' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- MDTF – Meta Data and Taxonomies Filter
- Affected
- up to 1.3.3.5
- What to do
- Affects up to 1.3.3.5. Update MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Metadata SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22516 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hpinfosys Metadata SEO metadata-seo allows Stored XSS.This issue affects Metadata SEO: from n/a through <= 2.3.
- Product
- Metadata SEO
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Metadata SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025RumbleTalk Live Group Chat: Missing AuthorizationCVE-2023-45828 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.2.5.
- Product
- RumbleTalk Live Group Chat
- Affected
- up to 6.2.5
- What to do
- Affects up to 6.2.5. Update RumbleTalk Live Group Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP Meta and Date Remover: Missing AuthorizationCVE-2023-47836 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in prasadkirpekar WP Meta and Date Remover wp-meta-and-date-remover allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meta and Date Remover: from n/a through <= 2.3.0.
- Product
- WP Meta and Date Remover
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WP Meta and Date Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Meta slider and carousel with lightbox: Missing AuthorizationCVE-2023-25703 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta slider and carousel with lightbox: from n/a through 1.6.2.
- Product
- Meta slider and carousel with lightbox
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Meta slider and carousel with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Easy CSV Importer BETA: Unrestricted Upload of File with Dangerous TypeCVE-2024-52372 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in WebTechGlobal Easy CSV Importer BETA easy-csv-importer allows Upload a Web Shell to a Web Server.This issue affects Easy CSV Importer BETA: from n/a through <= 7.0.0.
- Product
- Easy CSV Importer BETA
- Affected
- up to 7.0.0
- What to do
- Affects up to 7.0.0. Update Easy CSV Importer BETA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Meta Store Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51592 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mystical Themes Meta Store Elements meta-store-elements allows DOM-Based XSS.This issue affects Meta Store Elements: from n/a through <= 1.0.9.
- Product
- Meta Store Elements
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Meta Store Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2024User Meta – User Profile Builder and User management: Insecure Direct Object ReferenceCVE-2024-9262 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.1 via the getUser() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to obtain user meta values from form fields. Please note that this requires a site administrator to create a form that displays potentially sensitive information like password hashes. This may also be exploited by unauthenticated users if the 'user-meta-public-profile' shortcode is used insecurely.
- Product
- User Meta – User Profile Builder and User management
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update User Meta – User Profile Builder and User management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2024-43235 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.9.10.
- Product
- Meta Box – WordPress Custom Fields Framework
- Affected
- up to 5.9.10
- What to do
- Affects up to 5.9.10. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Meta News: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50435 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Meta News meta-news.This issue affects Meta News: from n/a through <= 1.1.7.
- Product
- Meta News
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Meta News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.