Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

259 results · page 3 of 6

Oct 25, 2025Tutor LMS – eLearning and online course solution: Sensitive Information ExposureCVE-2025-6680 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with tutor-level access and above, to view assignments for courses they don't teach which may contain sensitive information.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2025Tutor LMS Pro – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2025-6639 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students.
Product
Tutor LMS Pro – eLearning and online course solution
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update Tutor LMS Pro – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 25, 2025Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2025-11564 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025RestroPress – Online Food Ordering System: Authentication BypassCVE-2025-9209 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.
Product
RestroPress – Online Food Ordering System
Affected
3.0.0 to 3.1.9.2
What to do
Affects 3.0.0 to 3.1.9.2. Update RestroPress – Online Food Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 22, 2025eZee Online Hotel Booking Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58661 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eZee Technosys eZee Online Hotel Booking Engine online-booking-engine allows Stored XSS.This issue affects eZee Online Hotel Booking Engine: from n/a through <= 1.0.0.
Product
eZee Online Hotel Booking Engine
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update eZee Online Hotel Booking Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2025iATS Online Forms: Time-based SQL InjectionCVE-2025-9441 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
iATS Online Forms
Affected
up to 1.2
What to do
Affects up to 1.2. Update iATS Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 20, 2025Online Booking & Scheduling Calendar for WordPress by vcita: Unrestricted Upload of File with Dangerous TypeCVE-2025-54677 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.3.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Build App Online: Cross-Site Request Forgery (CSRF)CVE-2025-53249 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through <= 1.0.23.
Product
Build App Online
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Online Booking & Scheduling Calendar for WordPress by vcita: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54676 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Stored XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.3.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2025Tutor LMS Pro – eLearning and online course solution: Time-based SQL InjectionCVE-2025-6184 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected.
Product
Tutor LMS Pro – eLearning and online course solution
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Tutor LMS Pro – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tutorlms.com wordpress.org
Jul 23, 2025Qwizcards | online quizzes and flashcards: Does not sanitise and escape the "_stylesheet" parameter before outputting it back in the pageCVE-2025-6174 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user.
Product
Qwizcards | online quizzes and flashcards
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Qwizcards | online quizzes and flashcards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 18, 2025Zuppler Online Ordering: Cross-Site Request ForgeryCVE-2025-6053 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Zuppler Online Ordering
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Zuppler Online Ordering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 27, 2025PlatiOnline Payments: Missing AuthorizationCVE-2025-53288 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlatiOnline Payments: from n/a through <= 7.0.0.
Product
PlatiOnline Payments
Affected
up to 7.0.0
What to do
Affects up to 7.0.0. Update PlatiOnline Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025WP Online Users Stats: Cross-Site Request ForgeryCVE-2025-4966 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation within the hk_dataset_results() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Online Users Stats
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Online Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 6, 2025WP Online Users Stats: Time-based SQL InjectionCVE-2025-4964 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘table_name’ parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Online Users Stats
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Online Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 16, 2025SEO Flow by LupsOnline: Cross-Site Request Forgery (CSRF)CVE-2025-48146 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Michael Lups SEO Flow by LupsOnline lupsonline-link-netwerk allows Stored XSS.This issue affects SEO Flow by LupsOnline: from n/a through <= 2.2.1.
Product
SEO Flow by LupsOnline
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update SEO Flow by LupsOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Planning Center Online Giving: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11502 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Planning Center Online Giving
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Planning Center Online Giving to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025ApplyOnline: Does not protect uploaded files during the application processCVE-2024-10098 · WordPress plugins & themes · reported by WPScanLow 2.7
The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain
Product
ApplyOnline
Fixed in
2.6.3
What to do
Update ApplyOnline to 2.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 7, 2025Beds24 Online Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47489 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through <= 2.0.29.
Product
Beds24 Online Booking
Affected
up to 2.0.29
What to do
Affects up to 2.0.29. Update Beds24 Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025WP Online Users Stats: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32603 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK WP Online Users Stats wp-online-users-stats allows Blind SQL Injection.This issue affects WP Online Users Stats: from n/a through <= 1.0.0.
Product
WP Online Users Stats
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Online Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Build App Online: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32577 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.
Product
Build App Online
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025MyWorks WooCommerce Sync for QuickBooks Online: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32524 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyWorks MyWorks WooCommerce Sync for QuickBooks Online myworks-woo-sync-for-quickbooks-online allows Reflected XSS.This issue affects MyWorks WooCommerce Sync for QuickBooks Online: from n/a through <= 2.9.1.
Product
MyWorks WooCommerce Sync for QuickBooks Online
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update MyWorks WooCommerce Sync for QuickBooks Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Online Booking & Scheduling Calendar for WordPress by vcita: Generation of Error Message Containing Sensitive InformationCVE-2025-32238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Retrieve Embedded Sensitive Data.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Beds24 Online Booking: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32155 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows PHP Local File Inclusion.This issue affects Beds24 Online Booking: from n/a through <= 2.0.28.
Product
Beds24 Online Booking
Affected
up to 2.0.28
What to do
Affects up to 2.0.28. Update Beds24 Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Beds24 Online Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31851 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through <= 2.0.27.
Product
Beds24 Online Booking
Affected
up to 2.0.27
What to do
Affects up to 2.0.27. Update Beds24 Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Planyo online reservation system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31811 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through <= 3.1.
Product
Planyo online reservation system
Affected
up to 3.1
What to do
Affects up to 3.1. Update Planyo online reservation system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Unauthenticated Post TrashingCVE-2025-2290 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Affected
up to 8.0.1
What to do
Affects up to 8.0.1. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 5, 2025WP Online Contract: Unauthorized accessCVE-2025-0954 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the json_import() and json_export() functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's settings.
Product
WP Online Contract
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update WP Online Contract to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 3, 2025Swift Calendar Online Appointment Scheduling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SwiftCloud Swift Calendar Online Appointment Scheduling online-appointment-scheduling-software allows Reflected XSS.This issue affects Swift Calendar Online Appointment Scheduling: from n/a through <= 1.3.3.
Product
Swift Calendar Online Appointment Scheduling
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Swift Calendar Online Appointment Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 21, 2025igumbi Online Booking: Stored Cross-Site ScriptingCVE-2024-13455 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The igumbi Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'igumbi_calendar' shortcode in all versions up to, and including, 1.40 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
igumbi Online Booking
Affected
up to 1.40
What to do
Affects up to 1.40. Update igumbi Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Online Payments – Get Paid with PayPal, Square & Stripe: Stored Cross-Site ScriptingCVE-2024-11895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Online Payments – Get Paid with PayPal, Square & Stripe
Affected
up to 3.20.0
What to do
Affects up to 3.20.0. Update Online Payments – Get Paid with PayPal, Square & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2025Form To Online Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23653 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabeel Tahir Form To Online Booking cf7-calendly-integration allows Reflected XSS.This issue affects Form To Online Booking: from n/a through <= 1.0.
Product
Form To Online Booking
Affected
up to 1.0
What to do
Affects up to 1.0. Update Form To Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Sensly Online Presence: Does not sanitise and escape some of its settingsCVE-2024-13493 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Sensly Online Presence
Affected
up to 0.6
What to do
Affects up to 0.6. Update Sensly Online Presence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 11, 2025SuperSaaS – online appointment scheduling: Stored Cross-Site ScriptingCVE-2025-0862 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is limited to Chromium-based browsers (e.g. Chrome, Edge, Brave).
Product
SuperSaaS – online appointment scheduling
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update SuperSaaS – online appointment scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Food Menu – Restaurant Menu & Online Ordering for WooCommerce: Unauthorized accessCVE-2024-13415 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function in all versions up to, and including, 5.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings.
Product
Food Menu – Restaurant Menu & Online Ordering for WooCommerce
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update Food Menu – Restaurant Menu & Online Ordering for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025brodos.net Onlineshop: Stored Cross-Site ScriptingCVE-2024-12529 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The brodos.net Onlineshop Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'BrodosCategory' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
brodos.net Onlineshop
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update brodos.net Onlineshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 23, 2025University Quizzes Online: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oleksandr87 University Quizzes Online university-quizzes-online allows Reflected XSS.This issue affects University Quizzes Online: from n/a through <= 1.4.
Product
University Quizzes Online
Affected
up to 1.4
What to do
Affects up to 1.4. Update University Quizzes Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025ApplyOnline: Missing AuthorizationCVE-2025-22721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Farhan Noor ApplyOnline apply-online allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline: from n/a through <= 2.6.7.1.
Product
ApplyOnline
Affected
up to 2.6.7.1
What to do
Affects up to 2.6.7.1. Update ApplyOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Online Payments – Get Paid with PayPal, Square & Stripe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22661 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Payments – Get Paid with PayPal, Square & Stripe paypal-payment-button-by-vcita allows Stored XSS.This issue affects Online Payments – Get Paid with PayPal, Square & Stripe: from n/a through <= 3.20.0.
Product
Online Payments – Get Paid with PayPal, Square & Stripe
Affected
up to 3.20.0
What to do
Affects up to 3.20.0. Update Online Payments – Get Paid with PayPal, Square & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 13, 2025Food Store – Online Food Delivery & Pickup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22314 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Scripts Food Store – Online Food Delivery & Pickup food-store allows Reflected XSS.This issue affects Food Store – Online Food Delivery & Pickup: from n/a through <= 1.5.4.
Product
Food Store – Online Food Delivery & Pickup
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Food Store – Online Food Delivery & Pickup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 20253DVieweronline: Stored Cross-Site ScriptingCVE-2024-12514 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 3DVieweronline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
3DVieweronline
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update 3DVieweronline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Build App Online: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-49649 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.
Product
Build App Online
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025ApplyOnline – Application Form Builder and Manager: Missing AuthorizationCVE-2023-46080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Farhan Noor ApplyOnline – Application Form Builder and Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline – Application Form Builder and Manager: from n/a through 2.5.3.
Product
ApplyOnline – Application Form Builder and Manager
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update ApplyOnline – Application Form Builder and Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 20, 2024Sell Tickets Online – TicketSource Ticket Shop for: Stored Cross-Site ScriptingCVE-2024-11784 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop' shortcode in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sell Tickets Online – TicketSource Ticket Shop for
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Sell Tickets Online – TicketSource Ticket Shop for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Arbitrary post deletionCVE-2024-12596 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Cross-Site Request Forgery (CSRF)CVE-2024-54356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5
What to do
Affects up to 4.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Blaze Online eParcel for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54240 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through <= 1.3.3.
Product
Blaze Online eParcel for WooCommerce
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Blaze Online eParcel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling: Unauthorized loss of dataCVE-2024-11275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.
Product
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses: Unauthorized accessCVE-2024-12172 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.
Product
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Affected
up to 3.2.21
What to do
Affects up to 3.2.21. Update WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2024-9872 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_user_data_callback() function in all versions up to, and including, 4.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts and update settings.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.