Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

495new WordPress flaws this week

394,829entries in the database

41,225 results · page 399 of 825

Mar 15, 2025WP AntiDDOS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zzmaster WP AntiDDOS wpantiddos allows Reflected XSS.This issue affects WP AntiDDOS: from n/a through <= 2.0.
Product
WP AntiDDOS
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP AntiDDOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Debug-Bar-Extender: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows Reflected XSS.This issue affects Debug-Bar-Extender: from n/a through <= 0.5.
Product
Debug-Bar-Extender
Affected
up to 0.5
What to do
Affects up to 0.5. Update Debug-Bar-Extender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025WP Discord Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26554 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Reflected XSS.This issue affects WP Discord Post: from n/a through <= 2.1.0.
Product
WP Discord Post
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Discord Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Pre Order Addon for WooCommerce – Advance Order/Backorder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spring Devs Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin wc-pre-order allows Reflected XSS.This issue affects Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin: from n/a through <= 2.2.
Product
Pre Order Addon for WooCommerce – Advance Order/Backorder
Affected
up to 2.2
What to do
Affects up to 2.2. Update Pre Order Addon for WooCommerce – Advance Order/Backorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Random Image Selector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kdmurray Random Image Selector random-image-selector allows Reflected XSS.This issue affects Random Image Selector: from n/a through <= 2.4.
Product
Random Image Selector
Affected
up to 2.4
What to do
Affects up to 2.4. Update Random Image Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Random Posts, Mp3 Player + ShareButton: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23744 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton random-posts-mp3-player-sharebutton allows Reflected XSS.This issue affects Random Posts, Mp3 Player + ShareButton: from n/a through <= 1.4.1.
Product
Random Posts, Mp3 Player + ShareButton
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Random Posts, Mp3 Player + ShareButton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access of dataCVE-2025-2025 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.22.0
What to do
Affects up to 3.22.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025Tripetto: Cross-Site Request ForgeryCVE-2025-1530 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Tripetto
Affected
up to 8.0.9
What to do
Affects up to 8.0.9. Update Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025WP Test Email: Stored Cross-Site ScriptingCVE-2025-2325 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Test Email
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update WP Test Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 15, 2025Thumbnail carousel slider: SQL InjectionCVE-2019-25222 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Thumbnail carousel slider plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Thumbnail carousel slider
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Thumbnail carousel slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025Traveler: Reflected Cross-Site ScriptingCVE-2025-1773 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Traveler
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record travelerwp.com wordfence.com
Mar 15, 2025Traveler: Local File InclusionCVE-2025-1771 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
Traveler
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record travelerwp.com wordfence.com
Mar 15, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Stored Cross-Site ScriptingCVE-2024-13497 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.9
What to do
Affects up to 8.0.9. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025WP01: Arbitrary File DownloadCVE-2025-2267 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the make_archive() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-30567 is a duplicate of this issue.
Product
WP01
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update WP01 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 15, 2025pixelstats: Reflected Cross-Site ScriptingCVE-2025-2164 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
pixelstats
Affected
up to 0.8.2
What to do
Affects up to 0.8.2. Update pixelstats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025Zoorum Comments: Cross-Site Request ForgeryCVE-2025-2163 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorum_set_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Zoorum Comments
Affected
up to 0.9
What to do
Affects up to 0.9. Update Zoorum Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025School Management System – WPSchoolPress: SQL InjectionCVE-2025-1670 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.16
What to do
Affects up to 2.2.16. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025School Management System – WPSchoolPress: SQL InjectionCVE-2025-1669 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with teacher-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.17
What to do
Affects up to 2.2.17. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025School Management System – WPSchoolPress: Arbitrary user deletionCVE-2025-1668 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_DeleteUser() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to delete arbitrary user accounts.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.16
What to do
Affects up to 2.2.16. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025School Management System – WPSchoolPress: Privilege EscalationCVE-2025-1667 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTeacher() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to update arbitrary user details including email which makes it possible to request a password reset and access arbitrary user accounts, including administrators.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.16
What to do
Affects up to 2.2.16. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025WC Affiliate – A Complete WooCommerce Affiliate: Unauthorized access of dataCVE-2024-12336 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'export_all_data' function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive affiliate data, including personally identifiable information (PII).
Product
WC Affiliate – A Complete WooCommerce Affiliate
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update WC Affiliate – A Complete WooCommerce Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025Directory Listings WordPress plugin – uListing: Unauthorized modification of data and PHP Object InjectionCVE-2025-1657 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update post meta data and inject PHP Objects that may be unserialized. A capability check was added in 2.1.8, but the unserialize is still present.
Product
Directory Listings WordPress plugin – uListing
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Directory Listings WordPress plugin – uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 14, 2025Directory Listings WordPress plugin – uListing: Privilege EscalationCVE-2025-1653 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user meta that can be updated. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Product
Directory Listings WordPress plugin – uListing
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Directory Listings WordPress plugin – uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 14, 2025The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, andCVE-2025-2232 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.purethemes.net wordfence.com
Mar 14, 2025Civi - Job Board & Freelance Marketplace: Sensitive Information ExposureCVE-2024-13773 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive data including LinkedIn client and secret keys.
Product
Civi - Job Board & Freelance Marketplace
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Civi - Job Board & Freelance Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost wordfence.com
Mar 14, 2025Civi - Job Board & Freelance Marketplace: Authentication bypassCVE-2024-13772 · WordPress plugins & themes · reported by WordfenceMedium 5.6
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email.
Product
Civi - Job Board & Freelance Marketplace
Affected
up to 2.1.6.1
What to do
Affects up to 2.1.6.1. Update Civi - Job Board & Freelance Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025Civi - Job Board & Freelance Marketplace: Authentication bypassCVE-2024-13771 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.
Product
Civi - Job Board & Freelance Marketplace
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Civi - Job Board & Freelance Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025JobCareer | Job Board Responsive: Unauthorized access, modification, and loss of dataCVE-2024-12810 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 7.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files, generate backups, restore backups, update theme options, and reset theme options to default settings.
Product
JobCareer | Job Board Responsive
Affected
up to 7.1
What to do
Affects up to 7.1. Update JobCareer | Job Board Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025ShareThis Dashboard for Google Analytics: Unauthorized modification of dataCVE-2025-1507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_actions() function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all features.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2025DethemeKit for Elementor: Stored Cross-Site ScriptingCVE-2025-1526 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget (countdown feature) in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DethemeKit for Elementor
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update DethemeKit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025Omnipress: Information ExposureCVE-2024-13407 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Omnipress
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2025AnalyticsWP: SQL InjectionCVE-2024-13321 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AnalyticsWP plugin for WordPress is vulnerable to SQL Injection via the 'custom_sql' parameter in all versions up to, and including, 2.0.0 due to insufficient authorization checks on the handle_get_stats() function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
AnalyticsWP
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update AnalyticsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record analyticswp.com wordfence.com
Mar 14, 2025WPCOM Member: Time-based SQL InjectionCVE-2025-2221 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and including, 1.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPCOM Member
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update WPCOM Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025CiyaShop - Multipurpose WooCommerce: PHP Object InjectionCVE-2024-13824 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.19.0 via deserialization of untrusted input in the 'add_ciyashop_wishlist' and 'ciyashop_get_compare' functions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
CiyaShop - Multipurpose WooCommerce
Affected
up to 4.19.0
What to do
Affects up to 4.19.0. Update CiyaShop - Multipurpose WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025Zegen - Church: Unauthorized accessCVE-2025-2289 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import, export, and update theme options.
Product
Zegen - Church
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Zegen - Church to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025SoundRise Music: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2103 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on theironMusic_ajax() function in all versions up to, and including, 1.6.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
SoundRise Music
Affected
up to 1.6.11
What to do
Affects up to 1.6.11. Update SoundRise Music to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025LoginPress | wp-login Custom Login Page Customizer: Cross-Site Request ForgeryCVE-2025-1764 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.
Product
LoginPress | wp-login Custom Login Page Customizer
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update LoginPress | wp-login Custom Login Page Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025Eco Nature - Environment & Ecology: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-0952 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' AJAX action in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Product
Eco Nature - Environment & Ecology
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Eco Nature - Environment & Ecology to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025InstaWP Connect – 1-click WP Staging & Migration: Cross-Site Request ForgeryCVE-2024-13913 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.83
What to do
Affects up to 0.1.0.83. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025Industrial: Unauthorized modification of data that can lead to privilege escalationCVE-2024-13376 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the _ajax_get_total_content_import_items() function in all versions up to, and including, 1.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Industrial
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Industrial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025CM FAQ – Simplify support with an intuitive FAQ management tool: Reflected Cross-Site ScriptingCVE-2025-2166 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CM FAQ – Simplify support with an intuitive FAQ management tool
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update CM FAQ – Simplify support with an intuitive FAQ management tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025WP Ghost (Hide My WP Ghost) – Security & Firewall: Path TraversalCVE-2025-2056 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information.
Product
WP Ghost (Hide My WP Ghost) – Security & Firewall
Affected
up to 5.4.01
What to do
Affects up to 5.4.01. Update WP Ghost (Hide My WP Ghost) – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2025Search & Filter Pro: Unauthorized access of dataCVE-2025-1528 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function in all versions up to, and including, 2.5.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the values of arbitrary post meta.
Product
Search & Filter Pro
Affected
up to 2.5.19
What to do
Affects up to 2.5.19. Update Search & Filter Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record searchandfilter.com wordfence.com
Mar 14, 2025Resido - Real Estate: Unauthorized accessCVE-2025-1285 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and save_api_key AJAX actions in all versions up to, and including, 3.6. This makes it possible for unauthenticated attackers to issue requests to internal services and update API key details.
Product
Resido - Real Estate
Affected
up to 3.6
What to do
Affects up to 3.6. Update Resido - Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025VidoRev Extensions: Unauthorized accessCVE-2025-0955 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos.
Product
VidoRev Extensions
Affected
up to 2.9.9.9.9.9.5
What to do
Affects up to 2.9.9.9.9.9.5. Update VidoRev Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025WP JobHunt: Authentication bypassCVE-2024-11286 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the cs_parse_request() function. This makes it possible for unauthenticated attackers to to log in to any user's account, including administrators.
Product
WP JobHunt
Affected
up to 7.1
What to do
Affects up to 7.1. Update WP JobHunt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025WP JobHunt: Privilege escalationCVE-2024-11285 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the account_settings_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
WP JobHunt
Affected
up to 7.1
What to do
Affects up to 7.1. Update WP JobHunt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025WP JobHunt: Privilege escalationCVE-2024-11284 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the plugin not properly validating a user's identity prior to updating their password through the account_settings_save_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
WP JobHunt
Affected
up to 6.9
What to do
Affects up to 6.9. Update WP JobHunt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025WP JobHunt: Authentication bypassCVE-2024-11283 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax_google_api_login_callback function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to access arbitrary candidate accounts.
Product
WP JobHunt
Affected
up to 7.1
What to do
Affects up to 7.1. Update WP JobHunt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 13, 2025All-in-One WP Migration and Backup: PHP Object InjectionCVE-2024-10942 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89 via deserialization of untrusted input in the 'replace_serialized_values' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must export and restore a backup in order to trigger the exploit.
Product
All-in-One WP Migration and Backup
Affected
up to 7.89
What to do
Affects up to 7.89. Update All-in-One WP Migration and Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.