Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

1,119 results · page 4 of 23

Mar 13, 2026wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML ouCVE-2026-22210 · WordPress plugins & themes · reported by VulnCheckLow 2.1
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into theCVE-2026-22204 · WordPress plugins & themes · reported by VulnCheckMedium 6.3
wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafCVE-2026-22202 · WordPress plugins & themes · reported by VulnCheckMedium 6.1
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 24, 2026Responsive Lightbox & Gallery: Is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious linkCVE-2025-15386 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.
Product
Responsive Lightbox & Gallery
Fixed in
2.6.1
What to do
Update Responsive Lightbox & Gallery to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Feb 19, 2026xmlrpc attacks blocker: Stored Cross-Site ScriptingCVE-2026-2502 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' HTTP header. This is due to the plugin trusting and logging attacker-controlled IP header data and rendering debug log entries without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page.
Product
xmlrpc attacks blocker
Affected
up to 1.0
What to do
Affects up to 1.0. Update xmlrpc attacks blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 12, 2026Prime Listing Manager: Allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secretCVE-2025-14892 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secret.
Product
Prime Listing Manager
Affected
up to 1.1
What to do
Affects up to 1.1. Update Prime Listing Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 11, 2026WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered loCVE-2019-25315 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered log file paths. Attackers can add log files with embedded XSS payloads that will execute when viewed in the WordPress admin interface.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com exploit-db.com
Feb 1, 2026Stripe Green Downloads Wordpress Plugin 2.03 contains a persistent cross-site scripting vulnerability allowing remote attackers to inject malicious scripts in bCVE-2022-50797 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Stripe Green Downloads Wordpress Plugin 2.03 contains a persistent cross-site scripting vulnerability allowing remote attackers to inject malicious scripts in button label fields. Attackers can exploit input parameters to execute arbitrary scripts, potentially leading to session hijacking and application module manipulation.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record halfdata.com vulncheck.com
Jan 20, 2026Tutor LMS – eLearning and online course solution: Unauthorized attachment deletionCVE-2026-0548 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 13, 2026Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries.CVE-2023-54333 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted POST requests with malicious SQL payloads to retrieve and potentially steal entire database contents.
Product
Social-Share-Buttons
What to do
Update Social-Share-Buttons to the newest version.
Full record and what to do →NVD record github.com supsystic.com
Jan 2, 2026Ninja Forms: Allows unauthenticated attackers to generate valid access tokens via the REST APICVE-2025-14072 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.
Product
Ninja Forms
Fixed in
3.13.3
What to do
Update Ninja Forms to 3.13.3 or newer.
Full record and what to do →NVD record wpscan.com
Dec 31, 2025WP Attachments: Missing AuthorizationCVE-2025-62888 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Marco Milesi WP Attachments wp-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attachments: from n/a through <= 5.2.
Product
WP Attachments
Affected
up to 5.2
What to do
Affects up to 5.2. Update WP Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 29, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68499 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.12.
Product
JetTabs
Affected
up to 2.2.12
What to do
Affects up to 2.2.12. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 29, 2025JetTabs: Missing AuthorizationCVE-2025-68498 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12.
Product
JetTabs
Affected
up to 2.2.12
What to do
Affects up to 2.2.12. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 19, 2025Attachments Handler: Reflected Cross-Site ScriptingCVE-2025-12581 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Attachments Handler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Attachments Handler
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Attachments Handler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 18, 2025Etta: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53430 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Etta etta allows PHP Local File Inclusion.This issue affects Etta: from n/a through <= 1.14.0.
Product
Etta
Affected
up to 1.14.0
What to do
Affects up to 1.14.0. Update Etta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Import external attachments: Missing AuthorizationCVE-2025-64245 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import external attachments: from n/a through <= 1.5.12.
Product
Import external attachments
Affected
up to 1.5.12
What to do
Affects up to 1.5.12. Update Import external attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025CSV to SortTable: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-13070 · WordPress plugins & themes · reported by WPScanMedium 6.6
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
Product
CSV to SortTable
Affected
up to 4.2
What to do
Affects up to 4.2. Update CSV to SortTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 6, 2025List Attachments Shortcode: Stored Cross-Site ScriptingCVE-2025-12717 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The List Attachments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_list' parameter in the [list-attachments] shortcode in all versions up to, and including, 0.4.1a due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
List Attachments Shortcode
Affected
up to 0.4.1a
What to do
Affects up to 0.4.1a. Update List Attachments Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 26, 2025SortTable Post: Stored Cross-Site ScriptingCVE-2025-12649 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SortTable Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the sorttablepost shortcode in all versions up to, and including, 4.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via mouse interaction.
Product
SortTable Post
Affected
up to 4.2
What to do
Affects up to 4.2. Update SortTable Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 24, 2025The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing themCVE-2025-12628 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Nov 21, 2025BrightTALK WordPress Shortcode: Stored Cross-Site ScriptingCVE-2025-11770 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BrightTALK WordPress Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the brighttalk-time shortcode in all versions up to, and including, 2.4.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BrightTALK WordPress Shortcode
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update BrightTALK WordPress Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 18, 2025CSV to SortTable: Stored Cross-Site ScriptingCVE-2025-12823 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CSV to SortTable
Affected
up to 4.2
What to do
Affects up to 4.2. Update CSV to SortTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.com wordfence.com
Nov 15, 2025All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic: Unauthorized arbitrary media attachment deletionCVE-2025-12847 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint `/wp-json/aioseo/v1/ai/image-generator` only verifying that users have the `edit_posts` capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs.
Product
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
Affected
up to 4.8.9
What to do
Affects up to 4.8.9. Update All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 26, 2025Custom Post Type Attachment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62907 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Custom Post Type Attachment custom-post-type-pdf-attachment allows Stored XSS.This issue affects Custom Post Type Attachment: from n/a through <= 3.4.6.
Product
Custom Post Type Attachment
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Custom Post Type Attachment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Email Attachment by Order Status & Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49957 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Email Attachment by Order Status & Products email-attachment-by-order-status-products allows Reflected XSS.This issue affects Email Attachment by Order Status & Products: from n/a through <= 1.0.1.
Product
Email Attachment by Order Status & Products
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Email Attachment by Order Status & Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to downloCVE-2025-10638 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address
Product
NS Maintenance Mode for WP
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update NS Maintenance Mode for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 15, 2025Zip Attachments: Unauthorized access of dataCVE-2025-11701 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts.
Product
Zip Attachments
Affected
up to 1.6
What to do
Affects up to 1.6. Update Zip Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025Zip Attachments: Unauthorized loss of dataCVE-2025-11692 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory.
Product
Zip Attachments
Affected
up to 1.6
What to do
Affects up to 1.6. Update Zip Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 20, 2025JetTabs: Insertion of Sensitive Information Into Sent DataCVE-2025-53985 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTabs jet-tabs allows Retrieve Embedded Sensitive Data.This issue affects JetTabs: from n/a through <= 2.2.9.
Product
JetTabs
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54687 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.9.1.
Product
JetTabs
Affected
up to 2.2.9.1
What to do
Affects up to 2.2.9.1. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 21, 2025WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests.CVE-2025-54352 · WordPress plugins & themes · reported by MITRELow 3.7
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.
Affected
up to 6.8.2
What to do
Affects up to 6.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record imperva.com
Jul 18, 2025Attachment Manager: Arbitrary file deletionCVE-2025-7643 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_actions() function in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Attachment Manager
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Attachment Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 16, 2025Medical Prescription Attachment Plugin for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-29009 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce medical-prescription-attachment-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Medical Prescription Attachment Plugin for WooCommerce: from n/a through <= 1.2.3.
Product
Medical Prescription Attachment Plugin for WooCommerce
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Medical Prescription Attachment Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53984 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through <= 2.2.9.
Product
JetTabs
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 8, 2025An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary userCVE-2025-34077 · WordPress plugins & themes · reported by VulnCheckCritical 10
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 27, 2025Import external attachments: Cross-Site Request Forgery (CSRF)CVE-2025-53268 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Cross Site Request Forgery.This issue affects Import external attachments: from n/a through <= 1.5.12.
Product
Import external attachments
Affected
up to 1.5.12
What to do
Affects up to 1.5.12. Update Import external attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Download Attachments: Authorization Bypass Through User-Controlled KeyCVE-2025-49995 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.3.1.
Product
Download Attachments
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Download Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 13, 2025Auto Attachments: Stored Cross-Site ScriptingCVE-2025-6012 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Auto Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Auto Attachments
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Auto Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Jun 2, 2025wpForo + wpForo Advanced Attachments: Stored Cross-Site ScriptingCVE-2025-4224 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload names in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
wpForo + wpForo Advanced Attachments
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update wpForo + wpForo Advanced Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gvectors.com wordfence.com
May 28, 2025WP Attachments: Reflected Cross-Site ScriptingCVE-2025-5082 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attachment_id’ parameter in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Attachments
Affected
up to 5.0.12
What to do
Affects up to 5.0.12. Update WP Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2025JetTabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39450 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.7.
Product
JetTabs
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to maniCVE-2024-0970 · WordPress plugins & themes · reported by WPScanMedium 5.3
This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
Fixed in
4.1.4
What to do
Update the plugin to 4.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Apr 24, 2025Hacklog Remote Attachment: Cross-Site Request Forgery (CSRF)CVE-2025-46530 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Attachment hacklog-remote-attachment allows Stored XSS.This issue affects Hacklog Remote Attachment: from n/a through <= 1.3.2.
Product
Hacklog Remote Attachment
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Hacklog Remote Attachment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025AT Internet SmartTag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32506 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BenDlz AT Internet SmartTag at-internet allows Reflected XSS.This issue affects AT Internet SmartTag: from n/a through <= 0.2.
Product
AT Internet SmartTag
Affected
up to 0.2
What to do
Affects up to 0.2. Update AT Internet SmartTag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Klarna Checkout for WooCommerce: Exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per requestCVE-2024-13925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.
Product
Klarna Checkout for WooCommerce
Fixed in
2.13.5
What to do
Update Klarna Checkout for WooCommerce to 2.13.5 or newer.
Full record and what to do →NVD record wpscan.com
Apr 9, 2025Canonical Attachments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32543 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hivedigital Canonical Attachments canonical-attachments allows Reflected XSS.This issue affects Canonical Attachments: from n/a through <= 1.8.
Product
Canonical Attachments
Affected
up to 1.8
What to do
Affects up to 1.8. Update Canonical Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025Botnet Attack Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.
Product
Botnet Attack Blocker
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Botnet Attack Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2025WordPress Report Brute Force Attacks and Login Protection ReportAttacks: SQL InjectionCVE-2025-2250 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WordPress Report Brute Force Attacks and Login Protection ReportAttacks
Affected
up to 2.32
What to do
Affects up to 2.32. Update WordPress Report Brute Force Attacks and Login Protection ReportAttacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Mar 3, 2025Attach Gallery Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23441 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dkukral Attach Gallery Posts attach-gallery-posts allows Reflected XSS.This issue affects Attach Gallery Posts: from n/a through <= 1.6.
Product
Attach Gallery Posts
Affected
up to 1.6
What to do
Affects up to 1.6. Update Attach Gallery Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.