Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

279new WordPress flaws this week

393,576entries in the database

40,919 results · page 309 of 819

Aug 9, 2025The7: Stored Cross-Site ScriptingCVE-2025-7726 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to insufficient input sanitization and output escaping. The theme’s JavaScript reads user-supplied 'title' and 'data-dt-img-description' attributes directly via jQuery.attr(), concatenates them into an HTML string, and inserts that string into the DOM using methods such as jQuery.html() without escaping or filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The7
Affected
up to 12.6.0
What to do
Affects up to 12.6.0. Update The7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record the7.io themeforest.net
Aug 8, 2025Eventin: Privilege escalationCVE-2025-4796 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticated attackers with contributor-level and above permissions to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
Eventin
Affected
up to 4.0.34
What to do
Affects up to 4.0.34. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2025OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-6572 · WordPress plugins & themes · reported by WPScanMedium 5.9
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2025An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3.CVE-2025-54940 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.6
An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp advancedcustomfields.com
Aug 7, 2025Post SMTP: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-24000 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.
Product
Post SMTP
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-8620 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 6, 2025Gutenverse: Stored Cross-Site ScriptingCVE-2025-7727 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenverse
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Gutenverse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 6, 2025Element Pack Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-8100 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Elementor Addons and Templates
Affected
up to 8.1.5
What to do
Affects up to 8.1.5. Update Element Pack Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 6, 2025Exclusive Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-7498 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and including, 2.7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Exclusive Addons for Elementor
Affected
up to 2.7.9.4
What to do
Affects up to 2.7.9.4. Update Exclusive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 6, 2025Betheme: Stored Cross-Site ScriptingCVE-2025-7399 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Betheme
Affected
up to 28.1.3
What to do
Affects up to 28.1.3. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 6, 2025Reveal Listing plugin by smartdatasoft: Privilege escalationCVE-2025-6994 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'listing_user_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
Product
Reveal Listing plugin by smartdatasoft
Affected
up to 3.3
What to do
Affects up to 3.3. Update Reveal Listing plugin by smartdatasoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 5, 2025Zakra: Unauthorized data modificationCVE-2025-8595 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo settings.
Product
Zakra
Affected
up to 4.1.5
What to do
Affects up to 4.1.5. Update Zakra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org themes.trac.wordpress.org
Aug 5, 2025Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emCVE-2025-8420 · WordPress plugins & themes · reported by WordfenceHigh 8.1
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025WPBakery Page Builder for: Stored Cross-Site ScriptingCVE-2025-7502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and including, 8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPBakery Page Builder for
Affected
up to 8.5
What to do
Affects up to 8.5. Update WPBakery Page Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record kb.wpbakery.com wordfence.com
Aug 5, 2025CleverReach® WP: Time-based SQL InjectionCVE-2025-7036 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CleverReach® WP plugin for WordPress is vulnerable to time-based SQL Injection via the ‘title’ parameter in all versions up to, and including, 1.5.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2025-49059 may be a duplicate of this issue.
Product
CleverReach® WP
Affected
up to 1.5.20
What to do
Affects up to 1.5.20. Update CleverReach® WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025FileBird – WordPress Media Library Folders & File Manager: SQL InjectionCVE-2025-6986 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 6.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025WP Tournament Registration: Stored Cross-Site ScriptingCVE-2025-6690 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Tournament Registration
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update WP Tournament Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 5, 2025esri-map-view: Stored Cross-Site ScriptingCVE-2025-6259 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The esri-map-view plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's esri-map-view shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
esri-map-view
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update esri-map-view to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 5, 2025Flex Guten: Stored Cross-Site ScriptingCVE-2025-6256 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flex Guten
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Flex Guten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025the third-party `uploadify.php` script: WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file uploadCVE-2012-10027 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
Product
the third-party `uploadify.php` script
Affected
up to 1.35.0
What to do
Affects up to 1.35.0. Update the third-party `uploadify.php` script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record web.archive.org raw.githubusercontent.com
Aug 5, 2025upload.php: The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file uploadCVE-2012-10026 · WordPress plugins & themes · reported by VulnCheckCritical 10
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
Product
upload.php
What to do
Update upload.php to the newest version.
Full record and what to do →NVD record web.archive.org raw.githubusercontent.com
Aug 5, 2025core/actions/export.php: The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI)CVE-2012-10025 · WordPress plugins & themes · reported by VulnCheckCritical 10
The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.
Product
core/actions/export.php
What to do
Update core/actions/export.php to the newest version.
Full record and what to do →NVD record web.archive.org raw.githubusercontent.com
Aug 5, 2025Employee Directory: Stored Cross-Site ScriptingCVE-2025-8295 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Employee Directory
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Employee Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025Download Counter: Stored Cross-Site ScriptingCVE-2025-8294 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Counter
Affected
up to 1.3
What to do
Affects up to 1.3. Update Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-6207 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' function in all versions up to, and including, 3.9.28. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP Import Export Lite
Affected
up to 3.9.28
What to do
Affects up to 3.9.28. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025WP Import Export Lite: Arbitrary file uploadsCVE-2025-5061 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29.
Product
WP Import Export Lite
Affected
up to 3.9.29
What to do
Affects up to 3.9.29. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025WP Easy Contact: Stored Cross-Site ScriptingCVE-2025-8315 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Easy Contact
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP Easy Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025Campus Directory: Stored Cross-Site ScriptingCVE-2025-8313 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Campus Directory
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Campus Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 5, 2025Use-your-Drive | Google Drive plugin for: Stored Cross-Site ScriptingCVE-2025-7050 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file metadata in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can be exploited by the lowest authentication level permitted to upload files, including unauthenticated users, once a file upload shortcode is published on a publicly accessible post.
Product
Use-your-Drive | Google Drive plugin for
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Use-your-Drive | Google Drive plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpcloudplugins.gitbook.io wordfence.com
Aug 2, 2025Brave Conversion Engine (PRO): Authentication BypassCVE-2025-7710 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the plugin not properly restricting a claimed identity while authenticating with Facebook. This makes it possible for unauthenticated attackers to log in as other users, including administrators.
Product
Brave Conversion Engine (PRO)
Affected
up to 0.7.7
What to do
Affects up to 0.7.7. Update Brave Conversion Engine (PRO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record getbrave.io wordfence.com
Aug 2, 2025Ocean Social Sharing: Stored Cross-Site ScriptingCVE-2025-7500 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ocean Social Sharing
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Ocean Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder): Unauthorized modification of dataCVE-2025-8488 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_hfe_compatibility_option_callback ()function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the compatibility option setting.
Product
Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security: Sensitive Information ExposureCVE-2025-6722 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire_* directory that automatically gets created and stores potentially sensitive files without any access restrictions. This makes it possible for unauthenticated attackers to extract sensitive data from various files like config.ini, debug.log, and more when directory listing is enabled on the server and the ~/wp-content/plugins/index.php file is missing or ignored.
Product
BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security
Affected
up to 4.5
What to do
Affects up to 4.5. Update BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025Image Gallery: Reflected Cross-Site ScriptingCVE-2025-8400 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Gallery
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 2, 2025Mmm Unity Loader: Stored Cross-Site ScriptingCVE-2025-8399 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mmm Unity Loader
Affected
up to 1.0
What to do
Affects up to 1.0. Update Mmm Unity Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 2, 2025Magic Edge – Lite: Stored Cross-Site ScriptingCVE-2025-8391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Magic Edge – Lite
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Magic Edge – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 2, 2025All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier: Reflected Cross-Site ScriptingCVE-2025-6832 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier
Affected
up to 2.0
What to do
Affects up to 2.0. Update All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2025Custom Word Cloud: Stored Cross-Site ScriptingCVE-2025-8317 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Custom Word Cloud
Affected
up to 0.3
What to do
Affects up to 0.3. Update Custom Word Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 2, 2025Medical Addon for Elementor: Stored Cross-Site ScriptingCVE-2025-8212 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Medical Addon for Elementor
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Medical Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 2, 2025WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons: Unauthorized modification of dataCVE-2025-8152 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard.
Product
WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025SEO Metrics: Privilege EscalationCVE-2025-6754 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function in all versions up to, and including, 1.0.15. Because the AJAX action only verifies a nonce, without checking the caller’s capabilities, a subscriber-level user can retrieve the token and then access the custom endpoint to obtain full administrator cookies.
Product
SEO Metrics
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update SEO Metrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization: Stored Cross-Site ScriptingCVE-2025-6626 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
Affected
up to 3.10.3
What to do
Affects up to 3.10.3. Update ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025360 Photo Spheres: Stored Cross-Site ScriptingCVE-2025-4588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
360 Photo Spheres
Affected
up to 1.3
What to do
Affects up to 1.3. Update 360 Photo Spheres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 2, 2025Qi Addons For Elementor: Stored Cross-Site ScriptingCVE-2025-8146 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Qi Addons For Elementor
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Qi Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 2, 2025Woffice Core: Arbitrary file deletionCVE-2025-7694 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and including, 5.4.26. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Woffice Core
Affected
up to 5.4.26
What to do
Affects up to 5.4.26. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hub.woffice.io themeforest.net
Aug 1, 2025The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor TemCVE-2025-6228 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Sina Posts`, `Sina Blog Post` and `Sina Table` widgets in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2025The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site ImportsCVE-2025-4684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.2.13.1
What to do
Affects up to 3.2.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 1, 2025The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Stored Cross-Site ScriptingCVE-2025-7646 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter in all versions up to, and including, 6.3.10 even when the user does not have the unfiltered_html capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 6.3.10
What to do
Affects up to 6.3.10. Update The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 1, 2025SureForms: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-5921 · WordPress plugins & themes · reported by WPScanMedium 5.8
The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.
Product
SureForms
Fixed in
1.7.2
What to do
Update SureForms to 1.7.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2025Stratum – Elementor Widgets: Stored Cross-Site ScriptingCVE-2025-7845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Stratum – Elementor Widgets
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Stratum – Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.