Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

514 results · page 4 of 11

Sep 22, 2025Compact Archives: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58001 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through <= 4.1.0.
Product
Compact Archives
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Compact Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2025The Hack Repair Guy's Plugin Archiver: Cross-Site Request ForgeryCVE-2025-10188 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation on the bulk_remove() function. This makes it possible for unauthenticated attackers to arbitrary directory deletion in /wp-content via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
The Hack Repair Guy's Plugin Archiver
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update The Hack Repair Guy's Plugin Archiver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 12, 2025The Hack Repair Guy's Plugin Archiver: Arbitrary file deletionCVE-2025-10176 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the prepare_items function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
The Hack Repair Guy's Plugin Archiver
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update The Hack Repair Guy's Plugin Archiver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 5, 2025Search Cloud One: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58883 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Harris Search Cloud One search-cloud-one allows Stored XSS.This issue affects Search Cloud One: from n/a through <= 2.2.5.
Product
Search Cloud One
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Search Cloud One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Search by Google: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58832 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Search by Google search-google allows Stored XSS.This issue affects Search by Google: from n/a through <= 1.9.
Product
Search by Google
Affected
up to 1.9
What to do
Affects up to 1.9. Update Search by Google to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025WP Publication Archive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58826 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Mann WP Publication Archive wp-publication-archive allows Stored XSS.This issue affects WP Publication Archive : from n/a through <= 3.0.1.
Product
WP Publication Archive
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update WP Publication Archive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Posts Table with Search & Sort: Missing AuthorizationCVE-2025-58613 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through <= 1.4.10.
Product
Posts Table with Search & Sort
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update Posts Table with Search & Sort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 31, 2025Barcode Scanner with Inventory & Order Manager: Missing AuthorizationCVE-2024-32589 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025NextGEN Gallery Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53224 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Koen Schuit NextGEN Gallery Search nextgen-gallery-search-galleries allows Reflected XSS.This issue affects NextGEN Gallery Search: from n/a through <= 2.12.
Product
NextGEN Gallery Search
Affected
up to 2.12
What to do
Affects up to 2.12. Update NextGEN Gallery Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Yandex Site search pinger: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48352 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sitesearch-yandex Yandex Site search pinger yandex-pinger allows Stored XSS.This issue affects Yandex Site search pinger: from n/a through <= 1.5.
Product
Yandex Site search pinger
Affected
up to 1.5
What to do
Affects up to 1.5. Update Yandex Site search pinger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Ajax Search Lite: Basic Information ExposureCVE-2025-7956 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows.
Product
Ajax Search Lite
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2025WP Fast Total Search: Cross-Site Request Forgery (CSRF)CVE-2025-57893 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fast Total Search: from n/a through <= 1.79.270.
Product
WP Fast Total Search
Affected
up to 1.79.270
What to do
Affects up to 1.79.270. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 21, 2025Bible SuperSearch: Stored Cross-Site ScriptingCVE-2025-8064 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bible SuperSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘selector_height’ parameter in all versions up to, and including, 6.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bible SuperSearch
Affected
up to 6.0.1
What to do
Affects up to 6.0.1. Update Bible SuperSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 20, 2025JS Archive List: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54726 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows SQL Injection.This issue affects JS Archive List: from n/a through < 6.1.6.
Product
JS Archive List
What to do
Update JS Archive List to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 19, 2025JS Archive List: Time-based SQL InjectionCVE-2025-7670 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JS Archive List plugin for WordPress is vulnerable to time-based SQL Injection via the build_sql_where() function in all versions up to, and including, 6.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
JS Archive List
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update JS Archive List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 14, 2025CM On Demand Search And Replace: Cross-Site Request Forgery (CSRF)CVE-2025-54728 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Cross Site Request Forgery.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.
Product
CM On Demand Search And Replace
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025CM On Demand Search And Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54727 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Stored XSS.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.
Product
CM On Demand Search And Replace
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Barcode Scanner with Inventory & Order Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54715 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.9.0.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025JobSearch: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52806 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in eyecix JobSearch wp-jobsearch allows PHP Local File Inclusion.This issue affects JobSearch: from n/a through < 3.0.8.
Product
JobSearch
What to do
Update JobSearch to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025SoundSt SEO Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49058 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sound Strategies SoundSt SEO Search soundst-seo-search allows Reflected XSS.This issue affects SoundSt SEO Search: from n/a through <= 1.2.3.
Product
SoundSt SEO Search
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update SoundSt SEO Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2025FiboSearch: Missing AuthorizationCVE-2025-47444 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiboSearch: from n/a through <= 1.32.1.
Product
FiboSearch
Affected
up to 1.32.1
What to do
Affects up to 1.32.1. Update FiboSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Stored XSS.This issue affects JetSearch: from n/a through <= 3.5.10.1.
Product
JetSearch
Affected
up to 3.5.10.1
What to do
Affects up to 3.5.10.1. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Real Estate Property 2024 Create Your Own Fields and Search Bar WP: Missing AuthorizationCVE-2025-48150 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin real-estate-right-now allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin: from n/a through <= 4.48.
Product
Real Estate Property 2024 Create Your Own Fields and Search Bar WP
Affected
up to 4.48
What to do
Affects up to 4.48. Update Real Estate Property 2024 Create Your Own Fields and Search Bar WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025NGG Smart Image Search: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52832 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows SQL Injection.This issue affects NGG Smart Image Search: from n/a through <= 3.4.1.
Product
NGG Smart Image Search
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025JobSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52798 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through < 3.0.6.
Product
JobSearch
What to do
Update JobSearch to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Automatically Hierarchic Categories in Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50048 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in Menu: from n/a through <= 2.0.9.
Product
Automatically Hierarchic Categories in Menu
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025JobSearch: Authorization Bypass Through User-Controlled KeyCVE-2025-49978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through < 3.0.6.
Product
JobSearch
What to do
Update JobSearch to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Oganro Travel Portal Search Widget for HotelBeds APITUDE API: Cross-Site Request Forgery (CSRF)CVE-2025-49966 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through <= 1.0.
Product
Oganro Travel Portal Search Widget for HotelBeds APITUDE API
Affected
up to 1.0
What to do
Affects up to 1.0. Update Oganro Travel Portal Search Widget for HotelBeds APITUDE API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Arconix FAQ: Missing AuthorizationCVE-2025-49874 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix FAQ: from n/a through <= 1.9.6.
Product
Arconix FAQ
Affected
up to 1.9.6
What to do
Affects up to 1.9.6. Update Arconix FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49858 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.17.
Product
Arconix Shortcodes
Affected
up to 2.1.17
What to do
Affects up to 2.1.17. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Ivory Search: Does not sanitise and escape some of its settingsCVE-2025-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Ivory Search
Fixed in
5.5.10
What to do
Update Ivory Search to 5.5.10 or newer.
Full record and what to do →NVD record wpscan.com
Jun 14, 2025XiSearch bar: Cross-Site Request ForgeryCVE-2025-6063 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The XiSearch bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6. This is due to missing or incorrect nonce validation on the 'xisearch-key-config' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
XiSearch bar
Affected
up to 2.6
What to do
Affects up to 2.6. Update XiSearch bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2025WC MyParcel Belgium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48279 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta.
Product
WC MyParcel Belgium
What to do
Update WC MyParcel Belgium to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Search with Typesense: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49304 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeManas Search with Typesense search-with-typesense allows Stored XSS.This issue affects Search with Typesense: from n/a through <= 2.0.10.
Product
Search with Typesense
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update Search with Typesense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 31, 2025Relevanssi – A Better Search: Stored Cross-Site ScriptingCVE-2025-5016 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 (Free) and 2.27.6 (Premium) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Relevanssi – A Better Search
Affected
up to 4.24.5
What to do
Affects up to 4.24.5. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.16.
Product
Arconix Shortcodes
Affected
up to 2.1.16
What to do
Affects up to 2.1.16. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Year Make Model Search for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48265 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through <= 1.0.11.
Product
Year Make Model Search for WooCommerce
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Year Make Model Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-8619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ajax Search Lite
Fixed in
4.12.3
What to do
Update Ajax Search Lite to 4.12.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Simple Nav Archives: Does not have CSRF check in placeCVE-2024-8398 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Simple Nav Archives
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Simple Nav Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 13, 2025Relevanssi – A Better Search: Time-based SQL InjectionCVE-2025-4396 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and <= 2.27.5 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.
Product
Relevanssi – A Better Search
Affected
up to 4.24.4
What to do
Affects up to 4.24.4. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 7, 2025Better Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47507 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allows DOM-Based XSS.This issue affects Better Search: from n/a through <= 4.1.0.
Product
Better Search
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025NGG Smart Image Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47503 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through <= 3.3.3.
Product
NGG Smart Image Search
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 6, 2025Relevanssi – A Better Search: Stored Cross-Site ScriptingCVE-2025-4054 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 (Free) and <= 2.27.4 (Premium), due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the search results.
Product
Relevanssi – A Better Search
Affected
up to 4.24.3
What to do
Affects up to 4.24.3. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 6, 2025Search Exclude: Unauthorized modification of dataCVE-2025-2821 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to modify plugin settings, excluding content from search results.
Product
Search Exclude
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Search Exclude to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 25, 2025JobSearch WP Job Board: Authentication bypassCVE-2024-11917 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.9.2. This is due to improper configurations in the 'jobsearch_xing_response_data_callback', 'set_access_tokes', and 'google_callback' functions. This makes it possible for unauthenticated attackers to log in as the first connected Xing user, or any connected Xing user if the Xing id is known. It is also possible for unauthenticated attackers to log in as the first connected Google user if the user has logged in, without subsequently logging out, in thirty days. The vulnerability was partially patched in version 2.8.4.
Product
JobSearch WP Job Board
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Apr 24, 2025GNA Search Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46540 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Mok GNA Search Shortcode gna-search-shortcode allows Stored XSS.This issue affects GNA Search Shortcode: from n/a through <= 0.9.5.
Product
GNA Search Shortcode
Affected
up to 0.9.5
What to do
Affects up to 0.9.5. Update GNA Search Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Arconix FAQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32531 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Reflected XSS.This issue affects Arconix FAQ: from n/a through <= 1.9.5.
Product
Arconix FAQ
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update Arconix FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24621 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.15.
Product
Arconix Shortcodes
Affected
up to 2.1.15
What to do
Affects up to 2.1.15. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025WP-Advanced-Search: Unrestricted Upload of File with Dangerous TypeCVE-2025-39538 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search wp-advanced-search allows Upload a Web Shell to a Web Server.This issue affects WP-Advanced-Search: from n/a through <= 3.3.9.4.
Product
WP-Advanced-Search
Affected
up to 3.3.9.4
What to do
Affects up to 3.3.9.4. Update WP-Advanced-Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Site Search 360: Cross-Site Request Forgery (CSRF)CVE-2025-39530 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dsky Site Search 360 site-search-360 allows Stored XSS.This issue affects Site Search 360: from n/a through <= 2.1.8.
Product
Site Search 360
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Site Search 360 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.