Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

495new WordPress flaws this week

395,110entries in the database

41,251 results · page 416 of 826

Feb 18, 2025Uncode: Stored Cross-Site ScriptingCVE-2024-13667 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and including, 2.9.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Uncode
Affected
up to 2.9.1.6
What to do
Affects up to 2.9.1.6. Update Uncode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.undsgn.com wordfence.com
Feb 18, 2025Tour Master - Tour Booking, Travel, Hotel: Time-based SQL InjectionCVE-2024-13369 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tour Master - Tour Booking, Travel, Hotel
Affected
up to 5.3.7
What to do
Affects up to 5.3.7. Update Tour Master - Tour Booking, Travel, Hotel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net support.goodlayers.com
Feb 18, 2025Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later: Cross-Site Request ForgeryCVE-2024-13718 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.26. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to modify/update/create other user's wishlists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later
Affected
up to 1.2.26
What to do
Affects up to 1.2.26. Update Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Threepress: Stored Cross-Site ScriptingCVE-2024-13395 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Threepress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'threepress' shortcode in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Threepress
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Threepress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more: Unauthorized accessCVE-2024-13316 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the apmswn_create_discount() function in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create coupons.
Product
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025CarSpot – Dealership Wordpress Classified: Privilege escalationCVE-2024-12860 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
CarSpot – Dealership Wordpress Classified
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update CarSpot – Dealership Wordpress Classified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 18, 2025Active Products Tables for WooCommerce. Use constructor to create tables: Reflected Cross-Site ScriptingCVE-2025-0864 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodes_set' parameter in all versions up to, and including, 1.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Active Products Tables for WooCommerce. Use constructor to create tables
Affected
up to 1.0.6.6
What to do
Affects up to 1.0.6.6. Update Active Products Tables for WooCommerce. Use constructor to create tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Ecwid by Lightspeed Ecommerce Shopping Cart: Cross-Site Request ForgeryCVE-2024-13795 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.27. This is due to missing or incorrect nonce validation on the ecwid_deactivate_feedback() function. This makes it possible for unauthenticated attackers to send deactivation messages on behalf of a site owner via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ecwid by Lightspeed Ecommerce Shopping Cart
Affected
up to 6.12.27
What to do
Affects up to 6.12.27. Update Ecwid by Lightspeed Ecommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Super Testimonials: Stored Cross-Site ScriptingCVE-2024-13704 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Super Testimonials
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Web Stories Enhancer – Level Up Your Web Stories: Stored Cross-Site ScriptingCVE-2024-13575 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'web_stories_enhancer' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Web Stories Enhancer – Level Up Your Web Stories
Affected
up to 1.3
What to do
Affects up to 1.3. Update Web Stories Enhancer – Level Up Your Web Stories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025aBlocks – WordPress Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2024-13465 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in the "markerView" attribute, in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
aBlocks – WordPress Gutenberg Blocks
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update aBlocks – WordPress Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Online Payments – Get Paid with PayPal, Square & Stripe: Stored Cross-Site ScriptingCVE-2024-11895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Online Payments – Get Paid with PayPal, Square & Stripe
Affected
up to 3.20.0
What to do
Affects up to 3.20.0. Update Online Payments – Get Paid with PayPal, Square & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Reflected Cross-Site ScriptingCVE-2024-11376 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 241114. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 241114
What to do
Affects up to 241114. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025MemorialDay: Cross-Site Request ForgeryCVE-2024-13523 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MemorialDay
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update MemorialDay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Affiliate Links: WordPress Plugin for Link Cloaking and Link Management: PHP Object InjectionCVE-2024-13556 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.1 via deserialization of untrusted input from an file export. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Affiliate Links: WordPress Plugin for Link Cloaking and Link Management
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Affiliate Links: WordPress Plugin for Link Cloaking and Link Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025SpeedSize Image & Video AI-Optimizer: Cross-Site Request ForgeryCVE-2024-13438 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on the 'speedsize_clear_css_cache_action' function. This makes it possible for unauthenticated attackers to clear the plugins cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
SpeedSize Image & Video AI-Optimizer
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update SpeedSize Image & Video AI-Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Shopwarden – Automated WooCommerce monitoring & testing: Cross-Site Request ForgeryCVE-2024-13315 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.11. This is due to missing or incorrect nonce validation on the save_setting() function. This makes it possible for unauthenticated attackers to update arbitrary options and achieve privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Shopwarden – Automated WooCommerce monitoring & testing
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Shopwarden – Automated WooCommerce monitoring & testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Mortgage Calculator / Loan Calculator: Stored Cross-Site ScriptingCVE-2025-0805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mortgage Calculator / Loan Calculator
Affected
up to 1.5.20
What to do
Affects up to 1.5.20. Update Mortgage Calculator / Loan Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Mortgage Lead Capture System: Cross-Site Request ForgeryCVE-2025-0796 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.11. This is due to missing or incorrect nonce validation on the 'wprequal_reset_defaults' action. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Mortgage Lead Capture System
Affected
up to 8.2.11
What to do
Affects up to 8.2.11. Update Mortgage Lead Capture System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 18, 2025Option Editor: Cross-Site Request Forgery in version 1CVE-2024-13852 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the plugin_page() function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Option Editor
What to do
Update Option Editor to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 18, 2025Reaction Buttons: Stored Cross-Site ScriptingCVE-2024-13848 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Reaction Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Reaction Buttons
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Reaction Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 18, 2025Keap Official Opt-in Forms: Local File InclusionCVE-2024-13725 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution.
Product
Keap Official Opt-in Forms
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Team Builder – Meet the Team: Unauthorized modification of dataCVE-2024-13687 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_team_builder_options() function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
Team Builder – Meet the Team
Affected
up to 1.3
What to do
Affects up to 1.3. Update Team Builder – Meet the Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Reset: Cross-Site Request ForgeryCVE-2024-13684 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the reset_db_page() function. This makes it possible for unauthenticated attackers to reset several tables in the database like comments, themes, plugins, and more via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Reset
Affected
up to 1.6
What to do
Affects up to 1.6. Update Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025GetBookingsWP – Appointments Booking Calendar Plugin For: Privilege escalationCVE-2024-13677 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.27. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
GetBookingsWP – Appointments Booking Calendar Plugin For
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update GetBookingsWP – Appointments Booking Calendar Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025File Uploads Addon for WooCommerce: Sensitive Information ExposureCVE-2024-13622 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments uploaded by customers.
Product
File Uploads Addon for WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update File Uploads Addon for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Sensitive Information ExposureCVE-2024-13609 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.
Product
1 Click WordPress Migration Plugin – 100% FREE for a limited time
Affected
up to 2.2
What to do
Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Simple Signup Form: SQL InjectionCVE-2024-13595 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including, 1.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Simple Signup Form
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Simple Signup Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Simplebooklet PDF Viewer and Embedder: Stored Cross-Site ScriptingCVE-2024-13588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' shortcode in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simplebooklet PDF Viewer and Embedder
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Simplebooklet PDF Viewer and Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Zigaform – Price Calculator & Cost Estimation Form Builder Lite: Stored Cross-Site ScriptingCVE-2024-13587 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_fvar' shortcode in all versions up to, and including, 7.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Zigaform – Price Calculator & Cost Estimation Form Builder Lite
Affected
up to 7.4.7
What to do
Affects up to 7.4.7. Update Zigaform – Price Calculator & Cost Estimation Form Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer): Stored Cross-Site ScriptingCVE-2024-13582 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdo_simple_pricing_table_free' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer)
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Simple Charts: Stored Cross-Site ScriptingCVE-2024-13581 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simple_chart' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Charts
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025WP-Asambleas: Stored Cross-Site ScriptingCVE-2024-13579 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'polls_popup' shortcode in all versions up to, and including, 2.85.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Asambleas
Affected
up to 2.85.0
What to do
Affects up to 2.85.0. Update WP-Asambleas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025WP-BibTeX: Stored Cross-Site ScriptingCVE-2024-13578 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-BibTeX
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update WP-BibTeX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025CATS Job Listings: Stored Cross-Site ScriptingCVE-2024-13577 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CATS Job Listings
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update CATS Job Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Gumlet Video: Stored Cross-Site ScriptingCVE-2024-13576 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gumlet Video
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Gumlet Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Zigaform – Form Builder Lite: Stored Cross-Site ScriptingCVE-2024-13573 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zigaform – Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_rfvar' shortcode in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Zigaform – Form Builder Lite
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update Zigaform – Form Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Simple Map No Api: Stored Cross-Site ScriptingCVE-2024-13565 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Map No Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Map No Api
Affected
up to 1.9
What to do
Affects up to 1.9. Update Simple Map No Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Cross-Site Request ForgeryCVE-2024-13555 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancel_actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
1 Click WordPress Migration Plugin – 100% FREE for a limited time
Affected
up to 2.2
What to do
Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 18, 2025WooODT Lite – Delivery & pickup date time location for WooCommerce: Full Path DisclosureCVE-2024-13540 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.5.1. This is due the /inc/bycwooodt_get_all_orders.php file being publicly accessible and generating a publicly visible error message. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
WooODT Lite – Delivery & pickup date time location for WooCommerce
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WooODT Lite – Delivery & pickup date time location for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025BigBuy Dropshipping Connector for WooCommerce: Full Path DisclosureCVE-2024-13538 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This is due the /vendor/cocur/slugify/bin/generate-default.php file being directly accessible and triggering an error. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
BigBuy Dropshipping Connector for WooCommerce
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update BigBuy Dropshipping Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Actionwear products sync: Full Path DisclosureCVE-2024-13535 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-setup.php file being publicly accessible with 'display_errors' set to true. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Actionwear products sync
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Actionwear products sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025magayo Lottery Results: Cross-Site Request ForgeryCVE-2024-13522 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
magayo Lottery Results
Affected
up to 2.0.12
What to do
Affects up to 2.0.12. Update magayo Lottery Results to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 18, 2025WP-FormAssembly: Stored Cross-Site ScriptingCVE-2024-13501 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-FormAssembly
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update WP-FormAssembly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Library Bookshelves: Stored Cross-Site ScriptingCVE-2024-13464 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Library Bookshelves plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bookshelf' shortcode in all versions up to, and including, 5.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Library Bookshelves
Affected
up to 5.10
What to do
Affects up to 5.10. Update Library Bookshelves to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Open Hours – Easy Opening Hours: Stored Cross-Site ScriptingCVE-2024-12813 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Open Hours – Easy Opening Hours
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Open Hours – Easy Opening Hours to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 18, 2025Easy MLS Listings Import: Stored Cross-Site ScriptingCVE-2024-12525 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy MLS Listings Import
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Easy MLS Listings Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2025Rapid Cache: Cache PoisoningCVE-2024-12314 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin storing HTTP headers in the cached data. This makes it possible for unauthenticated attackers to poison the cache with custom HTTP headers that may be unsanitized which can lead to Cross-Site Scripting.
Product
Rapid Cache
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Rapid Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 17, 2025ProfileGrid – User Profiles, Groups and Communities: Insecure Direct Object ReferenceCVE-2024-13740 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pm_messenger_show_messages function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read private conversations of other users.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.4.2
What to do
Affects up to 5.9.4.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 17, 2025ProfileGrid – User Profiles, Groups and Communities: Limited Server-Side Request ForgeryCVE-2024-13741 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pm_upload_image function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to download and view images, as well as validating if a non-image file exists, both on local or remote hosts.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.4.2
What to do
Affects up to 5.9.4.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.