Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

439new WordPress flaws this week

394,398entries in the database

41,159 results · page 348 of 824

May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9879 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Melapress File Monitor
Fixed in
2.1.1
What to do
Update Melapress File Monitor to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Auto Affiliate Links: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Auto Affiliate Links
Fixed in
6.4.7
What to do
Update Auto Affiliate Links to 6.4.7 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Taskbuilder: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9831 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Taskbuilder
Fixed in
3.0.9
What to do
Update Taskbuilder to 3.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directoryCVE-2024-9765 · WordPress plugins & themes · reported by WPScanMedium 6.5
The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9711 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9709 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025CYAN Backup: Does not sanitise and escape some of its settingsCVE-2024-9663 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
CYAN Backup
Fixed in
2.5.3
What to do
Update CYAN Backup to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025CYAN Backup: Does not sanitise and escape some of its settingsCVE-2024-9662 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
CYAN Backup
Fixed in
2.5.3
What to do
Update CYAN Backup to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-9645 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry
Fixed in
2.2.93
What to do
Update Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry to 2.2.93 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Popup Box: Does not sanitise and escape some of its settingsCVE-2024-9599 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Popup Box
Fixed in
4.7.8
What to do
Update Popup Box to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Free Booking Plugin for Hotels, Restaurants and Car Rentals: Does not have CSRF check in placeCVE-2024-9450 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack
Product
Free Booking Plugin for Hotels, Restaurants and Car Rentals
Fixed in
1.3.15
What to do
Update Free Booking Plugin for Hotels, Restaurants and Car Rentals to 1.3.15 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025RegistrationMagic: Does not sanitise and escape some of its settingsCVE-2024-9390 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
RegistrationMagic
Fixed in
6.0.2.1
What to do
Update RegistrationMagic to 6.0.2.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025AVIF Uploader: Does not sanitise uploaded SVG filesCVE-2024-9238 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
AVIF Uploader
Fixed in
1.1.1
What to do
Update AVIF Uploader to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Team: Does not sanitise and escape some of its settingsCVE-2024-9236 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Team
Fixed in
4.4.2
What to do
Update Team to 4.4.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Logo Slider: Does not have CSRF check in placeCVE-2024-9233 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Logo Slider
Fixed in
3.7.1
What to do
Update Logo Slider to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its settingsCVE-2024-9227 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.9.18
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.9.18 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Maspik: Does not sanitise and escape some of its settingsCVE-2024-9182 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
Maspik
Fixed in
2.1.3
What to do
Update Maspik to 2.1.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Polls CP: Does not sanitise and escape some of its poll settingsCVE-2024-8854 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
Product
Polls CP
Fixed in
1.0.77
What to do
Update Polls CP to 1.0.77 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Polls CP: Does not sanitise and escape some of its poll settingsCVE-2024-8851 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
Product
Polls CP
Fixed in
1.0.77
What to do
Update Polls CP to 1.0.77 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2024-8759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Nested Pages
Fixed in
3.2.9
What to do
Update Nested Pages to 3.2.9 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Z-Downloads: Does not sanitise and escape some parametersCVE-2024-8703 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs.
Product
Z-Downloads
Fixed in
1.11.6
What to do
Update Z-Downloads to 1.11.6 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Backup Database: Does not sanitise and escape some of its settingsCVE-2024-8702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Backup Database
Affected
up to 4.9
What to do
Affects up to 4.9. Update Backup Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025events-calendar: Does not sanitise and escape some of its settingsCVE-2024-8701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
events-calendar
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update events-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Event Calendar: Does not check for authorization on delete actionsCVE-2024-8700 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.
Product
Event Calendar
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Z-Downloads: Does not properly validate files uploadedCVE-2024-8699 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
Z-Downloads
Fixed in
1.11.5
What to do
Update Z-Downloads to 1.11.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Z-Downloads: Does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScriptCVE-2024-8673 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.
Product
Z-Downloads
Fixed in
1.11.7
What to do
Update Z-Downloads to 1.11.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-8670 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.29
What to do
Update Photo Gallery by 10Web to 1.8.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2024-8620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
MapPress Maps for
Fixed in
2.93
What to do
Update MapPress Maps for to 2.93 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-8619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ajax Search Lite
Fixed in
4.12.3
What to do
Update Ajax Search Lite to 4.12.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Page Builder: Pagelayer
Fixed in
1.9.0
What to do
Update Page Builder: Pagelayer to 1.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Quiz Maker: Does not sanitize and escape some of its settingsCVE-2024-8617 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Quiz Maker
Fixed in
6.5.9.9
What to do
Update Quiz Maker to 6.5.9.9 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-8542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Everest Forms
Fixed in
3.0.3.1
What to do
Update Everest Forms to 3.0.3.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-8493 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Events Calendar
Fixed in
6.6.4
What to do
Update Events Calendar to 6.6.4 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Hustle: Does not sanitise and escape some of its settingsCVE-2024-8492 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Hustle
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Page Builder: Pagelayer
Fixed in
1.8.8
What to do
Update Page Builder: Pagelayer to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Simple Nav Archives: Does not have CSRF check in placeCVE-2024-8398 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Simple Nav Archives
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Simple Nav Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025webtoffee-gdpr-cookie-consent: Does not properly sanitize and escape the IP headersCVE-2024-8397 · WordPress plugins & themes · reported by WPScanMedium 5.4
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.
Product
webtoffee-gdpr-cookie-consent
Fixed in
2.6.1
What to do
Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025webtoffee-gdpr-cookie-consent: Does not have CSRF checks in some bulk actionsCVE-2024-8286 · WordPress plugins & themes · reported by WPScanMedium 6.5
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks
Product
webtoffee-gdpr-cookie-consent
Fixed in
2.6.1
What to do
Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Download Manager: Does not sanitise and escape some of its settingsCVE-2024-8284 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Download Manager
Fixed in
3.2.99
What to do
Update Download Manager to 3.2.99 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025GamiPress: Does not have CSRF check in placeCVE-2024-8245 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
GamiPress
Fixed in
1.0.1
What to do
Update GamiPress to 1.0.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-8187 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Smart Post Show
Fixed in
3.0.1
What to do
Update Smart Post Show to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025BabelZ: Does not have CSRF check in some placesCVE-2024-8095 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
BabelZ
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update BabelZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Ntz Antispam: Does not have CSRF check in placeCVE-2024-8094 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Ntz Antispam
Affected
up to 2.0e
What to do
Affects up to 2.0e. Update Ntz Antispam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025JavaScript Logic: Does not have CSRF check in some placesCVE-2024-8090 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
JavaScript Logic
Affected
up to 0.1
What to do
Affects up to 0.1. Update JavaScript Logic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025PeoplePond: Does not have CSRF check in some placesCVE-2024-8085 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
PeoplePond
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update PeoplePond to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Widgets Reset: Does not have CSRF check in placeCVE-2024-8082 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Widgets Reset
Affected
up to 0.1
What to do
Affects up to 0.1. Update Widgets Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Custom Author Base: Does not have CSRF check in placeCVE-2024-8050 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Custom Author Base
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Custom Author Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Smooth Gallery Replacement: Does not have CSRF check in some placesCVE-2024-8032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Smooth Gallery Replacement
Affected
up to 1.0
What to do
Affects up to 1.0. Update Smooth Gallery Replacement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Secure Downloads: Is vulnerable does not properly restrictCVE-2024-8031 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php.
Product
Secure Downloads
Fixed in
1.2.3
What to do
Update Secure Downloads to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students pageCVE-2024-8009 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page
Product
Sensei LMS
Fixed in
4.20.0
What to do
Update Sensei LMS to 4.20.0 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.