Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

495new WordPress flaws this week

395,110entries in the database

41,251 results · page 415 of 826

Feb 19, 2025Education Addon for Elementor: Insecure Direct Object ReferenceCVE-2024-13854 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naedu_elementor_template shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract information from posts that are not public, including drafts, password protected, and restricted posts. This applies to posts created with Elementor only.
Product
Education Addon for Elementor
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Education Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Pure Chat – Live Chat & More!: Stored Cross-Site ScriptingCVE-2024-13736 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pure Chat – Live Chat & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘purechatWidgetName’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pure Chat – Live Chat & More!
Affected
up to 2.4
What to do
Affects up to 2.4. Update Pure Chat – Live Chat & More! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025PeproDev Ultimate Invoice: Insecure Direct Object ReferenceCVE-2024-13719 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for completed orders which can contain PII of users.
Product
PeproDev Ultimate Invoice
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 19, 2025Pollin: SQL InjectionCVE-2024-13712 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Pollin
Affected
up to 1.01.1
What to do
Affects up to 1.01.1. Update Pollin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Pollin: Reflected Cross-Site ScriptingCVE-2024-13711 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Pollin
Affected
up to 1.01.1
What to do
Affects up to 1.01.1. Update Pollin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Widget BUY.BOX: Stored Cross-Site ScriptingCVE-2024-13679 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Widget BUY.BOX
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Widget BUY.BOX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Categorized Gallery: SQL InjectionCVE-2024-13676 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Categorized Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' attribute of the 'image_gallery' shortcode in all versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Categorized Gallery
Affected
up to 2.0
What to do
Affects up to 2.0. Update Categorized Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Cosmic Blocks (40+) Content Editor Blocks Collection: Stored Cross-Site ScriptingCVE-2024-13674 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cosmic Blocks (40+) Content Editor Blocks Collection plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cwp_social_share' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cosmic Blocks (40+) Content Editor Blocks Collection
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Cosmic Blocks (40+) Content Editor Blocks Collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Coaching Staffs: Stored Cross-Site ScriptingCVE-2024-13663 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Coaching Staffs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstw-cs-table' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Coaching Staffs
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Coaching Staffs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Responsive Flickr Slideshow: Stored Cross-Site ScriptingCVE-2024-13660 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Flickr Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fshow' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Flickr Slideshow
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Responsive Flickr Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Store Locator Widget: Stored Cross-Site ScriptingCVE-2024-13657 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'storelocatorwidget' shortcode in all versions up to, and including, 2025r1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Store Locator Widget
Affected
up to 2025r1
What to do
Affects up to 2025r1. Update Store Locator Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Team Builder For WPBakery Page Builder(Formerly Visual Composer): Local File InclusionCVE-2024-13592 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'team-builder-vc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
Affected
up to 1.0
What to do
Affects up to 1.0. Update Team Builder For WPBakery Page Builder(Formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Team Builder For WPBakery Page Builder(Formerly Visual Composer): Stored Cross-Site ScriptingCVE-2024-13591 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'team-builder-vc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
Affected
up to 1.0
What to do
Affects up to 1.0. Update Team Builder For WPBakery Page Builder(Formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025YouTube Playlists with Schema: Stored Cross-Site ScriptingCVE-2024-13589 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The YouTube Playlists with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yt_grid' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
YouTube Playlists with Schema
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update YouTube Playlists with Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Trash Duplicate and 301 Redirect: Unauthorized loss of dataCVE-2024-13468 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-action-top' action in all versions up to, and including, 1.9. This makes it possible for unauthenticated attackers to delete arbitrary posts/pages.
Product
Trash Duplicate and 301 Redirect
Affected
up to 1.9
What to do
Affects up to 1.9. Update Trash Duplicate and 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 19, 2025WP Wiki Tooltip: Stored Cross-Site ScriptingCVE-2024-13462 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Wiki Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wiki' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Wiki Tooltip
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update WP Wiki Tooltip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Apptivo Business Site CRM: Cross-Site Request ForgeryCVE-2024-13405 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Apptivo Business Site CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation on the 'awp_ip_deny' page. This makes it possible for unauthenticated attackers to block IP addresses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Apptivo Business Site CRM
Affected
up to 5.3
What to do
Affects up to 5.3. Update Apptivo Business Site CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025ADFO – Custom data in admin dashboard: Stored Cross-Site ScriptingCVE-2024-13390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adfo_list' shortcode in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ADFO – Custom data in admin dashboard
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update ADFO – Custom data in admin dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily: Stored Cross-Site ScriptingCVE-2024-12522 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Digihood HTML Sitemap: Reflected Cross-Site ScriptingCVE-2024-12339 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Digihood HTML Sitemap plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘channel' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Digihood HTML Sitemap
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Digihood HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Lexicata: Reflected Cross-Site ScriptingCVE-2024-12069 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Lexicata plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link.
Product
Lexicata
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update Lexicata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025CanadaHelps Embedded Donation Form: Stored Cross-Site ScriptingCVE-2024-11778 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CanadaHelps Embedded Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedcdn' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CanadaHelps Embedded Donation Form
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update CanadaHelps Embedded Donation Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025UMich OIDC Login: Stored Cross-Site ScriptingCVE-2024-11753 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UMich OIDC Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'umich_oidc_button' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UMich OIDC Login
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update UMich OIDC Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included: Stored Cross-Site ScriptingCVE-2024-11335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframe' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 19, 2025Visualizer: Tables and Charts Manager for: Stored Cross-Site ScriptingCVE-2025-1065 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From File feature in all versions up to, and including, 3.11.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visualizer: Tables and Charts Manager for
Affected
up to 3.11.8
What to do
Affects up to 3.11.8. Update Visualizer: Tables and Charts Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025User Private Files – File Upload & Download Manager with Secure File Sharing: Stored Cross-Site ScriptingCVE-2024-13799 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘new-fldr-name’ parameter in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
User Private Files – File Upload & Download Manager with Secure File Sharing
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update User Private Files – File Upload & Download Manager with Secure File Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Master Slider: Does not sanitise and escape some of its settingsCVE-2024-12173 · WordPress plugins & themes · reported by WPScanLow 3.5
The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Master Slider
Fixed in
3.10.5
What to do
Update Master Slider to 3.10.5 or newer.
Full record and what to do →NVD record wpscan.com
Feb 19, 2025Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2025-1441 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wpr_filter_woo_products' function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1007
What to do
Affects up to 1.7.1007. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Age Verification for your checkout page.CVE-2025-22622 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 4.3
Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/class-wc-integration-agechecker-integration.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record fluidattacks.com wordpress.org
Feb 18, 2025Easypromos: Stored Cross-Site ScriptingCVE-2024-13443 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easypromos Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Easypromos shortcode in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easypromos
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Easypromos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Subscribe2 – Form, Email Subscribers & Newsletters: Stored Cross-Site ScriptingCVE-2024-11582 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ip parameter in all versions up to, and including, 10.43 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Subscribe2 – Form, Email Subscribers & Newsletters
Affected
up to 10.43
What to do
Affects up to 10.43. Update Subscribe2 – Form, Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Booking Package: Reflected Cross-Site ScriptingCVE-2024-13508 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Booking Package
Affected
up to 1.6.72
What to do
Affects up to 1.6.72. Update Booking Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Wonder Video Embed: Stored Cross-Site ScriptingCVE-2024-13743 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderplugin_video shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wonder Video Embed
Affected
up to 2.2
What to do
Affects up to 2.2. Update Wonder Video Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Drivr Lite – Google Drive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27016 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1.
Product
Drivr Lite – Google Drive
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Drivr Lite – Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025MediCenter - Health Medical Clinic: Missing AuthorizationCVE-2025-27013 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MediCenter - Health Medical Clinic: from n/a through < 14.7.
Product
MediCenter - Health Medical Clinic
What to do
Update MediCenter - Health Medical Clinic to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Paid Videochat Turnkey Site: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-22663 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Path Traversal.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.2.12.
Product
Paid Videochat Turnkey Site
Affected
up to 7.2.12
What to do
Affects up to 7.2.12. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Atarim: Missing AuthorizationCVE-2025-22657 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.0.9.
Product
Atarim
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Cookie Monster: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22656 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Oscar Alvarez Cookie Monster cookie-monster allows PHP Local File Inclusion.This issue affects Cookie Monster: from n/a through <= 1.2.2.
Product
Cookie Monster
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Cookie Monster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Simplified: Unrestricted Upload of File with Dangerous TypeCVE-2025-22654 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified simplified allows Using Malicious Files.This issue affects Simplified: from n/a through <= 1.0.6.
Product
Simplified
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Simplified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Smartarget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget smartarget-contact-us allows Stored XSS.This issue affects Smartarget: from n/a through <= 1.5.3.
Product
Smartarget
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Smartarget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Real Estate Manager: Improper Restriction of Excessive Authentication AttemptsCVE-2025-22645 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Password Brute Forcing.This issue affects Real Estate Manager: from n/a through <= 7.3.
Product
Real Estate Manager
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Distance Rate Shipping for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22639 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn Distance Rate Shipping for WooCommerce distance-rate-shipping-for-woocommerce-pro allows Blind SQL Injection.This issue affects Distance Rate Shipping for WooCommerce: from n/a through <= 1.3.4.
Product
Distance Rate Shipping for WooCommerce
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Distance Rate Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025K Elements: Incorrect Privilege AssignmentCVE-2024-56000 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through < 5.4.0.
Product
K Elements
What to do
Update K Elements to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Uncode Core: Arbitrary shortcode executionCVE-2024-13689 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
Uncode Core
Affected
up to 2.9.1.6
What to do
Affects up to 2.9.1.6. Update Uncode Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.undsgn.com wordfence.com
Feb 18, 2025FormCraft: Stored Cross-Site ScriptingCVE-2025-0817 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
FormCraft
Affected
up to 3.9.11
What to do
Affects up to 3.9.11. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net formcraft-wp.com
Feb 18, 2025Post SMTP: Stored Cross-Site ScriptingCVE-2025-0521 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post SMTP
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025PressMart - Modern Elementor WooCommerce: Arbitrary shortcode executionCVE-2024-13797 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
PressMart - Modern Elementor WooCommerce
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update PressMart - Modern Elementor WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 18, 2025FormCraft: Unauthorized access of dataCVE-2024-13783 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin data which may contain sensitive information from form submissions.
Product
FormCraft
Affected
up to 3.9.11
What to do
Affects up to 3.9.11. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net formcraft-wp.com
Feb 18, 2025Uncode: Arbitrary file readCVE-2024-13691 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' function in all versions up to, and including, 2.9.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary files on the server.
Product
Uncode
Affected
up to 2.9.1.6
What to do
Affects up to 2.9.1.6. Update Uncode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.undsgn.com wordfence.com
Feb 18, 2025Uncode: Arbitrary file readCVE-2024-13681 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' function in all versions up to, and including, 2.9.1.6. This makes it possible for unauthenticated attackers to read arbitrary files on the server.
Product
Uncode
Affected
up to 2.9.1.6
What to do
Affects up to 2.9.1.6. Update Uncode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.undsgn.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.