Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,159 results · page 351 of 824
May 15, 2025Nokaut Offers Box: Does not sanitize and escape some of its settingsCVE-2024-10632 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Nokaut Offers Box
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Nokaut Offers Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Countdown Timer for WordPress Block Editor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-10631 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Countdown Timer for WordPress Block Editor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Countdown Timer for WordPress Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Contact Form, Survey, Quiz & Popup Form Builder: Does not sanitise and escape some parametersCVE-2024-10504 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- Contact Form, Survey, Quiz & Popup Form Builder
- Fixed in
- 1.7.1
- What to do
- Update Contact Form, Survey, Quiz & Popup Form Builder to 1.7.1 or newer.
May 15, 2025Responsive Contact Form Builder & Lead Generation: Does not sanitise and escape some of its settingsCVE-2024-10475 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Responsive Contact Form Builder & Lead Generation
- Fixed in
- 1.9.8
- What to do
- Update Responsive Contact Form Builder & Lead Generation to 1.9.8 or newer.
May 15, 2025Social Media Share Buttons & Social Sharing Icons: Does not sanitize and escape some of its settingsCVE-2024-10362 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Media Share Buttons & Social Sharing Icons
- Fixed in
- 2.9.1
- What to do
- Update Social Media Share Buttons & Social Sharing Icons to 2.9.1 or newer.
May 15, 2025Social Slider Feed: Does not sanitise and escape some of its settingsCVE-2024-10149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Social Slider Feed
- Fixed in
- 2.2.9
- What to do
- Update Social Slider Feed to 2.2.9 or newer.
May 15, 2025Hubbub Lite: Does not sanitise and escape some of its settingsCVE-2024-10145 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Hubbub Lite
- Fixed in
- 1.34.4
- What to do
- Update Hubbub Lite to 1.34.4 or newer.
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-10144 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.22
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
May 15, 2025MB Custom Post Types & Custom Taxonomies: Does not sanitise and escape some of its settingsCVE-2024-10143 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MB Custom Post Types & Custom Taxonomies
- Fixed in
- 2.7.7
- What to do
- Update MB Custom Post Types & Custom Taxonomies to 2.7.7 or newer.
May 15, 2025Giveaways and Contests by RafflePress: Does not sanitise and escape some of its settingsCVE-2024-10107 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.12.17
- What to do
- Update Giveaways and Contests by RafflePress to 1.12.17 or newer.
May 15, 2025ApplyOnline: Does not protect uploaded files during the application processCVE-2024-10098 · WordPress plugins & themes · reported by WPScanLow 2.7
The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain
- Product
- ApplyOnline
- Fixed in
- 2.6.3
- What to do
- Update ApplyOnline to 2.6.3 or newer.
May 15, 2025Jetpack WordPress plugin before 13.8, Jetpack Boost: Use regexes in the Site Accelerator featuresCVE-2024-10076 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks
- Product
- Jetpack WordPress plugin before 13.8, Jetpack Boost
- Fixed in
- 13.8
- What to do
- Update Jetpack WordPress plugin before 13.8, Jetpack Boost to 13.8 or newer.
May 15, 2025Jetpack: Does not ensure that the post created by the Contact Form is only accessible to authorised usersCVE-2024-10075 · WordPress plugins & themes · reported by WPScanMedium 5.6
The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.
- Product
- Jetpack
- Fixed in
- 13.8
- What to do
- Update Jetpack to 13.8 or newer.
May 15, 2025Happyforms: Does not sanitise and escape some of its settingsCVE-2024-10054 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Happyforms
- Fixed in
- 1.26.3
- What to do
- Update Happyforms to 1.26.3 or newer.
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10009 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Melapress File Monitor
- Fixed in
- 2.1.0
- What to do
- Update Melapress File Monitor to 2.1.0 or newer.
May 15, 2025This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to maniCVE-2024-0970 · WordPress plugins & themes · reported by WPScanMedium 5.3
This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
- Fixed in
- 4.1.4
- What to do
- Update the plugin to 4.1.4 or newer.
May 15, 2025coreActivity: Activity Logging for: Does not escape some request dataCVE-2024-0852 · WordPress plugins & themes · reported by WPScanHigh 8.8
The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin
- Product
- coreActivity: Activity Logging for
- Fixed in
- 1.8.1
- What to do
- Update coreActivity: Activity Logging for to 1.8.1 or newer.
May 15, 2025Advanced Schedule Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0249 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.
- Product
- Advanced Schedule Posts
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Advanced Schedule Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025TwitterPosts: Does not have CSRF check in placeCVE-2023-7297 · WordPress plugins & themes · reported by WPScanLow 3.5
The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- TwitterPosts
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update TwitterPosts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP Dashboard Notes: Does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX actionCVE-2023-7239 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.
- Product
- WP Dashboard Notes
- Fixed in
- 1.0.11
- What to do
- Update WP Dashboard Notes to 1.0.11 or newer.
May 15, 2025illi Link Party!: Lacks proper access controlsCVE-2023-7231 · WordPress plugins & themes · reported by WPScanHigh 7.3
The illi Link Party! WordPress plugin through 1.0 lacks proper access controls, allowing unauthenticated visitors to delete links.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025illi Link Party!: Does not sanitize and escape some parametersCVE-2023-7230 · WordPress plugins & themes · reported by WPScanMedium 6.1
The illi Link Party! WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025illi Link Party!: Does not have CSRF check in placeCVE-2023-7229 · WordPress plugins & themes · reported by WPScanMedium 5.5
The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025illi Link Party!: Does not sanitise and escape some parametersCVE-2023-7228 · WordPress plugins & themes · reported by WPScanMedium 6.1
The illi Link Party! WordPress plugin through 1.0 does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site Scripting attacks.
- Product
- illi Link Party!
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update illi Link Party! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Marketing Twitter Bot: Does not have CSRF check in some placesCVE-2023-7197 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Marketing Twitter Bot WordPress plugin through 1.11 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Marketing Twitter Bot
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update Marketing Twitter Bot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Ultimate Noindex Nofollow Tool: Does not have CSRF check in placeCVE-2023-7196 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Ultimate Noindex Nofollow Tool
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ultimate Noindex Nofollow Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP-Reply Notify: Does not have a CSRF check in placeCVE-2023-7195 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- WP-Reply Notify
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP-Reply Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025aBitGone CommentSafe: Does not have CSRF check in some placesCVE-2023-7174 · WordPress plugins & themes · reported by WPScanHigh 7.1
The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- aBitGone CommentSafe
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update aBitGone CommentSafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Better Follow Button for Jetpack: Does not sanitise and escape some of its settingsCVE-2023-7168 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Better Follow Button for Jetpack
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Better Follow Button for Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Add SVG Support for Media Uploader | inventivo: Does not sanitize uploaded SVG filesCVE-2023-7088 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Add SVG Support for Media Uploader | inventivo
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Add SVG Support for Media Uploader | inventivo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025SVG Uploads Support: Does not sanitize uploaded SVG filesCVE-2023-7086 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- SVG Uploads Support
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update SVG Uploads Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Payment Gateway for Telcell: Does not validate the api_url parameter before redirecting the user to its valueCVE-2023-6786 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue
- Product
- Payment Gateway for Telcell
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Payment Gateway for Telcell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WolfNet IDX for: Does not sanitise and escape some of its settingsCVE-2023-6783 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WolfNet IDX for
- Affected
- up to 1.19.1
- What to do
- Affects up to 1.19.1. Update WolfNet IDX for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Allow SVG: Does not sanitize uploaded SVG filesCVE-2023-6541 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Allow SVG
- Fixed in
- 1.2.0
- What to do
- Update Allow SVG to 1.2.0 or newer.
May 15, 2025LogDash Activity Log: Hooks the wp_login_failed function (from src/Hooks/UsersCVE-2023-6030 · WordPress plugins & themes · reported by WPScanMedium 5.4
The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker
- Product
- LogDash Activity Log
- Fixed in
- 1.1.4
- What to do
- Update LogDash Activity Log to 1.1.4 or newer.
May 15, 2025Travelpayouts: All Travel Brands in One Place: Does not have CSRF check in placeCVE-2023-5934 · WordPress plugins & themes · reported by WPScanHigh 7.3
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack
- Product
- Travelpayouts: All Travel Brands in One Place
- Fixed in
- 1.1.13
- What to do
- Update Travelpayouts: All Travel Brands in One Place to 1.1.13 or newer.
May 15, 2025Travelpayouts: All Travel Brands in One Place: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5932 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Travelpayouts: All Travel Brands in One Place
- Fixed in
- 1.1.14
- What to do
- Update Travelpayouts: All Travel Brands in One Place to 1.1.14 or newer.
May 15, 2025Advanced Page Visit Counter: Does not sanitise and escape some of its settingsCVE-2023-5529 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Page Visit Counter
- Fixed in
- 8.0.6
- What to do
- Update Advanced Page Visit Counter to 8.0.6 or newer.
May 15, 2025edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector: Does not have CSRF checkCVE-2023-2334 · WordPress plugins & themes · reported by WPScanMedium 5.4
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector
- Fixed in
- 1.4
- What to do
- Update edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector to 1.4 or newer.
May 15, 2025WP2LEADS: Cross-Site Request Forgery (CSRF)CVE-2025-32922 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Stored XSS.This issue affects WP2LEADS: from n/a through <= 3.5.0.
- Product
- WP2LEADS
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Jetpack Debug Tools: Missing AuthorizationCVE-2024-56006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1.
- Product
- Jetpack Debug Tools
- Fixed in
- 2.0.1
- What to do
- Update Jetpack Debug Tools to 2.0.1 or newer.
May 15, 2025Tours: Missing AuthorizationCVE-2024-51666 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tosin Oguntuyi Tours tours.This issue affects Tours: from n/a through <= 1.0.0.
- Product
- Tours
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Tours to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Front End Users: Missing AuthorizationCVE-2025-47580 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through <= 3.2.35.
- Product
- Front End Users
- Affected
- up to 3.2.35
- What to do
- Affects up to 3.2.35. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025TicketBAI Facturas para WooCommerce: Arbitrary file deletionCVE-2025-4564 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf' action in all versions up to, and including, 3.18. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- TicketBAI Facturas para WooCommerce
- Affected
- up to 3.18
- What to do
- Affects up to 3.18. Update TicketBAI Facturas para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 15, 2025Responsive Lightbox & Gallery: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3742 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Lightbox & Gallery
- Fixed in
- 2.5.1
- What to do
- Update Responsive Lightbox & Gallery to 2.5.1 or newer.
May 15, 2025File Manager Advanced Shortcode: Local File InclusionCVE-2024-13914 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanced-shortcode) and 2.5.6 (advanced-file-manager-pro-premium), via the 'file_manager_advanced' shortcode. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Sites currently using 2.5.4 (file-manager-advanced-shortcode) should be updated to 2.6.0 (advanced-file-manager-pro-premium).
- Product
- File Manager Advanced Shortcode
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update File Manager Advanced Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordadvancedfilemanager.comwordfence.com
May 15, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Remote Code ExecutionCVE-2025-3053 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uip_process_form_input() function. This is due to the function taking user supplied inputs to execute arbitrary functions with arbitrary data, and does not have any sort of capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server.
- Product
- UiPress lite | Effortless custom dashboards, admin themes and pages
- Affected
- up to 3.5.07
- What to do
- Affects up to 3.5.07. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 15, 2025Weluka Lite: Stored Cross-Site ScriptingCVE-2025-4591 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Weluka Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Weluka Lite
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Weluka Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 15, 2025Bon Toolkit: Stored Cross-Site ScriptingCVE-2025-4589 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bon Toolkit
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Bon Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 15, 2025EG-Series: Stored Cross-Site ScriptingCVE-2025-4126 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode_title function. This makes it possible for authenticated attackers - with contributor-level access and above, on sites with the Classic Editor plugin activated - to inject arbitrary JavaScript code in the titletag attribute that will execute whenever a user access an injected page.
- Product
- EG-Series
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update EG-Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.