Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

518new WordPress flaws this week

395,110entries in the database

41,251 results · page 410 of 826

Feb 27, 2025Car Dealer Automotive WordPress Theme – Responsive: Arbitrary file deletionCVE-2025-1282 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_post_photo() and add_car() functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The add_car() function may also make it possible to read arbitrary files.
Product
Car Dealer Automotive WordPress Theme – Responsive
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Car Dealer Automotive WordPress Theme – Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 27, 2025Login Me Now: Authentication bypassCVE-2025-1717 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own.
Product
Login Me Now
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Login Me Now to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025ThemeMakers PayPal Express Checkout: Stored Cross-Site ScriptingCVE-2025-1689 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ThemeMakers PayPal Express Checkout
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update ThemeMakers PayPal Express Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com themeforest.net
Feb 27, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Server-Side Request ForgeryCVE-2024-13907 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.16.8
What to do
Affects up to 1.16.8. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025Templines Elementor Helper Core: Privilege escalationCVE-2025-1295 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowing arbitrary user meta updates. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to Administrator. The vulnerability can only be exploited when the BuddyPress plugin is also installed and activated.
Product
Templines Elementor Helper Core
Affected
up to 2.7
What to do
Affects up to 2.7. Update Templines Elementor Helper Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost wordfence.com
Feb 27, 2025Image Photo Gallery Final Tiles Grid: Stored Cross-Site ScriptingCVE-2024-6261 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025Bricks: Privilege EscalationCVE-2024-2297 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation checks placed on the create_autosave AJAX function. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary PHP code with elevated (administrator-level) privileges. NOTE: Successful exploitation requires (1) the Bricks Builder to be enabled for posts (2) Builder access to be enabled for contributor-level users, and (3) "Code Execution" to be enabled for administrator-level users within the theme's settings.
Product
Bricks
Affected
up to 1.9.6.1
What to do
Affects up to 1.9.6.1. Update Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bricksbuilder.io wordfence.com
Feb 27, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-0469 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.39.2
What to do
Affects up to 1.39.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2025OneStore Sites: Server-Side Request ForgeryCVE-2024-13905 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
OneStore Sites
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update OneStore Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2025School Management System – SakolaWP: Cross-Site Request ForgeryCVE-2024-13647 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The School Management System – SakolaWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the 'save_exam_setting' and 'delete_exam_setting' actions. This makes it possible for unauthenticated attackers to update exam settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
School Management System – SakolaWP
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update School Management System – SakolaWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 26, 2025Events Manager: Missing AuthorizationCVE-2025-1249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through <= 6.6.4.1.
Product
Events Manager
Affected
up to 6.6.4.1
What to do
Affects up to 6.6.4.1. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2025Admin Menu Manager: Cross-Site Request Forgery (CSRF)CVE-2025-26925 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/a through 1.0.3.
Product
Admin Menu Manager
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Admin Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2025The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2025-1517 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 26, 2025Quiz Organizer: Stored Cross-Site ScriptingCVE-2024-6810 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Quiz Organizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Quiz Organizer
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Quiz Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 26, 2025Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2024-13803 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-marker’ parameter in all versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost plugins.trac.wordpress.org
Feb 26, 2025R3W InstaFeed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13678 · WordPress plugins & themes · reported by WPScanMedium 6.1
The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
R3W InstaFeed
Affected
up to 1.0
What to do
Affects up to 1.0. Update R3W InstaFeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025CalendApp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13669 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
CalendApp
Affected
up to 1.1
What to do
Affects up to 1.1. Update CalendApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Post Sync: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13634 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Post Sync
Affected
up to 1.1
What to do
Affects up to 1.1. Update Post Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Simple catalogue: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13633 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Simple catalogue
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Simple catalogue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WP Extra Fields: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13632 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Extra Fields
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Om Stripe: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13631 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Om Stripe
Affected
up to 02.00.00
What to do
Affects up to 02.00.00. Update Om Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025NewsTicker: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13630 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
NewsTicker
Affected
up to 1.0
What to do
Affects up to 1.0. Update NewsTicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025pushBIZ: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13629 · WordPress plugins & themes · reported by WPScanMedium 6.1
The pushBIZ WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
pushBIZ
Affected
up to 1.0
What to do
Affects up to 1.0. Update pushBIZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WP Pricing Table: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13628 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Pricing Table
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WPMovieLibrary: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13624 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WPMovieLibrary
Affected
up to 2.1.4.8
What to do
Affects up to 2.1.4.8. Update WPMovieLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Post Timeline: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13571 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Post Timeline
Fixed in
2.3.10
What to do
Update Post Timeline to 2.3.10 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Subscriptions & Memberships for PayPal: Cross-Site Request ForgeryCVE-2024-13560 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Subscriptions & Memberships for PayPal
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Subscriptions & Memberships for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 26, 2025Countdown Timer for Elementor: Does not sanitise and escape some parametersCVE-2024-13113 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
Countdown Timer for Elementor
Fixed in
1.3.7
What to do
Update Countdown Timer for Elementor to 1.3.7 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Custom Block Builder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12878 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Custom Block Builder
Fixed in
3.8.3
What to do
Update Custom Block Builder to 3.8.3 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025WP BASE Booking of Appointments, Services and Events: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12737 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP BASE Booking of Appointments, Services and Events
Fixed in
5.0.0
What to do
Update WP BASE Booking of Appointments, Services and Events to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025SureMembers: Sensitive Information ExposureCVE-2024-12434 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.6 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive data including restricted content.
Product
SureMembers
Affected
up to 1.10.6
What to do
Affects up to 1.10.6. Update SureMembers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record suremembers.com wordfence.com
Feb 26, 2025WooCommerce Cart Count Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10563 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WooCommerce Cart Count Shortcode
Fixed in
1.1.0
What to do
Update WooCommerce Cart Count Shortcode to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Simple:Press Forum: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-10483 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Product
Simple:Press Forum
Fixed in
6.10.11
What to do
Update Simple:Press Forum to 6.10.11 or newer.
Full record and what to do →NVD record wpscan.com
Feb 26, 2025Simple Certain Time to Show Content: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-10152 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Simple Certain Time to Show Content
Fixed in
1.3.1
What to do
Update Simple Certain Time to Show Content to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Feb 25, 2025Simple Photo Feed: Missing AuthorizationCVE-2025-27000 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Photo Feed: from n/a through <= 1.4.0.
Product
Simple Photo Feed
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Simple Photo Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Market Exporter: Missing AuthorizationCVE-2025-26995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Anton Vanyukov Market Exporter market-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Market Exporter: from n/a through <= 2.0.21.
Product
Market Exporter
Affected
up to 2.0.21
What to do
Affects up to 2.0.21. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Atarim: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Reflected XSS.This issue affects Atarim: from n/a through <= 4.1.0.
Product
Atarim
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025WPPizza: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26991 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ollybach WPPizza wppizza allows Reflected XSS.This issue affects WPPizza: from n/a through <= 3.19.4.
Product
WPPizza
Affected
up to 3.19.4
What to do
Affects up to 3.19.4. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Frontend Admin by DynamiApps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26987 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Reflected XSS.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.25.17.
Product
Frontend Admin by DynamiApps
Affected
up to 3.25.17
What to do
Affects up to 3.25.17. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Majestic Support: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26985 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PHP Local File Inclusion.This issue affects Majestic Support: from n/a through <= 1.0.6.
Product
Majestic Support
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2025-26983 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.3.
Product
Recipe Card Blocks for Gutenberg & Elementor
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Recipe Card Blocks for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Web Accessibility By accessiBe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26981 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Reflected XSS.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.5.
Product
Web Accessibility By accessiBe
Affected
up to 2.5
What to do
Affects up to 2.5. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Wired Impact Volunteer Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26980 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Stored XSS.This issue affects Wired Impact Volunteer Management: from n/a through <= 2.5.
Product
Wired Impact Volunteer Management
Affected
up to 2.5
What to do
Affects up to 2.5. Update Wired Impact Volunteer Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Funnel Builder by FunnelKit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26979 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.9.0.
Product
Funnel Builder by FunnelKit
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update Funnel Builder by FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Filebird: Authorization Bypass Through User-Controlled KeyCVE-2025-26977 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through <= 6.4.2.1.
Product
Filebird
Affected
up to 6.4.2.1
What to do
Affects up to 6.4.2.1. Update Filebird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Strong Testimonials: Missing AuthorizationCVE-2025-26975 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Strong Testimonials: from n/a through <= 3.2.3.
Product
Strong Testimonials
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025WP Multistore Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26974 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Blind SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.1.
Product
WP Multistore Locator
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Poll Maker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26971 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Poll Maker poll-maker allows Blind SQL Injection.This issue affects Poll Maker: from n/a through <= 5.6.5.
Product
Poll Maker
Affected
up to 5.6.5
What to do
Affects up to 5.6.5. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025PrivateContent: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-26966 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.5.
Product
PrivateContent
Affected
up to 8.11.5
What to do
Affects up to 8.11.5. Update PrivateContent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Amelia: Authorization Bypass Through User-Controlled KeyCVE-2025-26965 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through <= 1.2.16.
Product
Amelia
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.