Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,251 results · page 411 of 826
Feb 25, 2025Eventin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26964 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.20.
- Product
- Eventin
- Affected
- up to 4.0.20
- What to do
- Affects up to 4.0.20. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025ClickWhale: Cross-Site Request Forgery (CSRF)CVE-2025-26963 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ClickWhale ClickWhale clickwhale allows Cross Site Request Forgery.This issue affects ClickWhale: from n/a through <= 2.4.3.
- Product
- ClickWhale
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Easy Contact Form Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26962 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Easy Contact Form Lite contact-form-lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through <= 1.1.25.
- Product
- Easy Contact Form Lite
- Affected
- up to 1.1.25
- What to do
- Affects up to 1.1.25. Update Easy Contact Form Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Small Package Quotes – Unishippers Edition: Missing AuthorizationCVE-2025-26960 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.9.
- Product
- Small Package Quotes – Unishippers Edition
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Affiliate Coupons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26957 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Deetronix Affiliate Coupons affiliate-coupons allows PHP Local File Inclusion.This issue affects Affiliate Coupons: from n/a through <= 1.7.3.
- Product
- Affiliate Coupons
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Affiliate Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Business Card Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Business Card Block business-card-block allows Stored XSS.This issue affects Business Card Block: from n/a through <= 1.0.5.
- Product
- Business Card Block
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Business Card Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Team Section Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26949 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XSS.This issue affects Team Section Block: from n/a through <= 1.0.9.
- Product
- Team Section Block
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Team Section Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Pie Register Premium: Missing AuthorizationCVE-2025-26948 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
- Product
- Pie Register Premium
- Affected
- up to 3.8.3.2
- What to do
- Affects up to 3.8.3.2. Update Pie Register Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Services Section block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26947 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows Stored XSS.This issue affects Services Section block: from n/a through <= 1.3.4.
- Product
- Services Section block
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Services Section block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025WP Yelp Review Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26946 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider wp-yelp-review-slider allows Blind SQL Injection.This issue affects WP Yelp Review Slider: from n/a through <= 8.1.
- Product
- WP Yelp Review Slider
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update WP Yelp Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Info Cards: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26945 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards info-cards allows Stored XSS.This issue affects Info Cards: from n/a through <= 1.0.5.
- Product
- Info Cards
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Info Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Easy Quotes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26943 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Blind SQL Injection.This issue affects Easy Quotes: from n/a through <= 1.2.2.
- Product
- Easy Quotes
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Easy Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Counters Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Counters Block counters-block allows Stored XSS.This issue affects Counters Block: from n/a through <= 1.1.2.
- Product
- Counters Block
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Counters Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Countdown Timer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer countdown-time allows Stored XSS.This issue affects Countdown Timer: from n/a through <= 1.2.6.
- Product
- Countdown Timer
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Countdown Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Icon List Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26937 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.1.3.
- Product
- Icon List Block
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Icon List Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025WP Job Portal: Path Traversal: '.../...//'CVE-2025-26935 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in wpjobportal WP Job Portal wp-job-portal allows PHP Local File Inclusion.This issue affects WP Job Portal: from n/a through <= 2.2.8.
- Product
- WP Job Portal
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025ChatBot: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26932 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QuantumCloud ChatBot chatbot allows PHP Local File Inclusion.This issue affects ChatBot: from n/a through <= 6.3.5.
- Product
- ChatBot
- Affected
- up to 6.3.5
- What to do
- Affects up to 6.3.5. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Tribulant Gallery Voting: Cross-Site Request Forgery (CSRF)CVE-2025-26931 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Tribulant Gallery Voting gallery-voting allows Stored XSS.This issue affects Tribulant Gallery Voting: from n/a through <= 1.2.1.
- Product
- Tribulant Gallery Voting
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Tribulant Gallery Voting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Order Limit for WooCommerce: Missing AuthorizationCVE-2025-26928 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Limit for WooCommerce: from n/a through <= 3.0.2.
- Product
- Order Limit for WooCommerce
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Order Limit for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Booknetic: Cross-Site Request Forgery (CSRF)CVE-2025-26926 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Booknetic Booknetic booknetic allows Cross Site Request Forgery.This issue affects Booknetic: from n/a before 5.10.4.
- Product
- Booknetic
- Fixed in
- 5.10.4
- What to do
- Update Booknetic to 5.10.4 or newer.
Feb 25, 2025Wishlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26915 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.41.
- Product
- Wishlist
- Affected
- up to 1.0.41
- What to do
- Affects up to 1.0.41. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025AR For: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26913 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress ar-for-wordpress allows DOM-Based XSS.This issue affects AR For WordPress: from n/a through <= 7.7.
- Product
- AR For
- Affected
- up to 7.7
- What to do
- Affects up to 7.7. Update AR For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Easy Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26912 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.6.
- Product
- Easy Elementor Addons
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025System Dashboard: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26911 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.
- Product
- System Dashboard
- Affected
- up to 2.8.18
- What to do
- Affects up to 2.8.18. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Mortgage Calculator Estatik: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26907 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows Stored XSS.This issue affects Mortgage Calculator Estatik: from n/a through <= 2.0.12.
- Product
- Mortgage Calculator Estatik
- Affected
- up to 2.0.12
- What to do
- Affects up to 2.0.12. Update Mortgage Calculator Estatik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Estatik: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26905 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through <= 4.3.0.
- Product
- Estatik
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update Estatik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025WP Responsive Auto Fit Text: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26904 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gal_op WP Responsive Auto Fit Text wp-responsive-slab-text allows DOM-Based XSS.This issue affects WP Responsive Auto Fit Text: from n/a through <= 0.2.
- Product
- WP Responsive Auto Fit Text
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update WP Responsive Auto Fit Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Flexmls® IDX: Deserialization of Untrusted DataCVE-2025-26900 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <= 3.14.27.
- Product
- Flexmls® IDX
- Affected
- up to 3.14.27
- What to do
- Affects up to 3.14.27. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025List Related Attachments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26897 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baden List Related Attachments list-related-attachments-widget allows DOM-Based XSS.This issue affects List Related Attachments: from n/a through <= 2.1.6.
- Product
- List Related Attachments
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update List Related Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025PiwigoPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26896 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vpiwigo PiwigoPress piwigopress allows Stored XSS.This issue affects PiwigoPress: from n/a through <= 2.33.
- Product
- PiwigoPress
- Affected
- up to 2.33
- What to do
- Affects up to 2.33. Update PiwigoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Easy Charts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kiran Potphode Easy Charts easy-charts allows DOM-Based XSS.This issue affects Easy Charts: from n/a through <= 1.2.3.
- Product
- Easy Charts
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Easy Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Ibtana: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26891 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Stored XSS.This issue affects Ibtana: from n/a through <= 1.2.5.9.
- Product
- Ibtana
- Affected
- up to 1.2.5.9
- What to do
- Affects up to 1.2.5.9. Update Ibtana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025EZ SQL Reports Shortcode Widget and DB Backup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.21.35.
- Product
- EZ SQL Reports Shortcode Widget and DB Backup
- Affected
- up to 5.21.35
- What to do
- Affects up to 5.21.35. Update EZ SQL Reports Shortcode Widget and DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 10.8.
- Product
- Greenshift
- Affected
- up to 10.8
- What to do
- Affects up to 10.8. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Popup Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26882 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Popup Builder easy-notify-lite allows Stored XSS.This issue affects Popup Builder: from n/a through <= 1.1.33.
- Product
- Popup Builder
- Affected
- up to 1.1.33
- What to do
- Affects up to 1.1.33. Update Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Sticky Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.
- Product
- Sticky Content
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Sticky Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Autoship Cloud for WooCommerce Subscription Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26878 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows DOM-Based XSS.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through <= 2.8.0.1.
- Product
- Autoship Cloud for WooCommerce Subscription Products
- Affected
- up to 2.8.0.1
- What to do
- Affects up to 2.8.0.1. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Front End Users: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26877 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.30.
- Product
- Front End Users
- Affected
- up to 3.2.30
- What to do
- Affects up to 3.2.30. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Search with Typesense: Path Traversal: '.../...//'CVE-2025-26876 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Path Traversal: '.../...//' vulnerability in CodeManas Search with Typesense search-with-typesense allows Path Traversal.This issue affects Search with Typesense: from n/a through <= 2.0.8.
- Product
- Search with Typesense
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Search with Typesense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Essential Blocks for Gutenberg: Missing AuthorizationCVE-2025-26871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Fast Flow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26868 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fastflow Fast Flow fast-flow-dashboard allows Reflected XSS.This issue affects Fast Flow: from n/a through <= 1.2.16.
- Product
- Fast Flow
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update Fast Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Broadcast Live Video: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26753 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through <= 6.2.
- Product
- Broadcast Live Video
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Broadcast Live Video: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26752 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through <= 6.2.
- Product
- Broadcast Live Video
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Alphabetic Pagination: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26751 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Alphabetic Pagination alphabetic-pagination allows Reflected XSS.This issue affects Alphabetic Pagination: from n/a through <= 3.2.1.
- Product
- Alphabetic Pagination
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Alphabetic Pagination to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54444 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.25.10.
- Product
- Elementor Website Builder
- Affected
- up to 3.25.10
- What to do
- Affects up to 3.25.10. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Advanced Google reCaptcha: CAPTCHA BypassCVE-2025-1262 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
- Product
- Advanced Google reCaptcha
- Affected
- up to 1.27
- What to do
- Affects up to 1.27. Update Advanced Google reCaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 25, 2025Enfold: Server-Side Request ForgeryCVE-2024-13695 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Enfold
- Affected
- up to 6.0.9
- What to do
- Affects up to 6.0.9. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 25, 2025Enfold: Unauthorized access of dataCVE-2024-13693 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9. This makes it possible for unauthenticated attackers to export all avia settings which may included sensitive information such as the Mailchimp API Key, reCAPTCHA Secret Key, or Envato private token if they are set.
- Product
- Enfold
- Affected
- up to 6.0.9
- What to do
- Affects up to 6.0.9. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 25, 2025WordPress File Upload: Cross-Site Request ForgeryCVE-2024-13494 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfu_file_details' function. This makes it possible for unauthenticated attackers to modify user data details associated with uploaded files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WordPress File Upload
- Affected
- up to 4.25.2
- What to do
- Affects up to 4.25.2. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 25, 2025Yawave: SQL InjectionCVE-2025-1648 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Yawave plugin for WordPress is vulnerable to SQL Injection via the 'lbid' parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Yawave
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Yawave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordatviksecurity.complugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.