Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

504new WordPress flaws this week

395,358entries in the database

41,262 results · page 421 of 826

Feb 12, 2025Admire Extra: Stored Cross-Site ScriptingCVE-2024-13665 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Admire Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'space' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Admire Extra
Affected
up to 1.6
What to do
Affects up to 1.6. Update Admire Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2025NGG Smart Image Search: Stored Cross-Site ScriptingCVE-2024-13658 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
NGG Smart Image Search
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2025Click Mag - Viral WordPress News Magazine/Blog: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13656 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including, 3.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
Click Mag - Viral WordPress News Magazine/Blog
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Click Mag - Viral WordPress News Magazine/Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 12, 2025ZoxPress - The All-In-One WordPress News: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13654 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'reset_options' function in all versions up to, and including, 2.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
ZoxPress - The All-In-One WordPress News
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update ZoxPress - The All-In-One WordPress News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 12, 2025ZoxPress - The All-In-One WordPress News: Unauthorized modification of data that can lead to privilege escalationCVE-2024-13653 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' functions in all versions up to, and including, 2.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
ZoxPress - The All-In-One WordPress News
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update ZoxPress - The All-In-One WordPress News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 12, 2025Real Estate 7: Privilege EscalationCVE-2024-13421 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account.
Product
Real Estate 7
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Real Estate 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record contempothemes.com themeforest.net
Feb 12, 2025WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon: Unauthorized modification of dataCVE-2024-12164 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwp_reset_settings() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
Product
WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon
Affected
up to 1.6
What to do
Affects up to 1.6. Update WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 12, 2025Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands: Stored Cross-Site ScriptingCVE-2024-11746 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_brand' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2025Houzez Property Feed: Cross-Site Request ForgeryCVE-2025-0808 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed exports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Houzez Property Feed
Affected
up to 2.4.21
What to do
Affects up to 2.4.21. Update Houzez Property Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 11, 2025StaffList: Cross-Site Request ForgeryCVE-2024-13749 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation on the 'stafflist' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
StaffList
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update StaffList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 11, 2025Liveticker (by stklcode): Stored Cross-Site ScriptingCVE-2024-13701 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Liveticker (by stklcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Liveticker (by stklcode)
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Liveticker (by stklcode) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 11, 2025The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification of dataCVE-2024-13554 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reorder_route() function in all versions up to, and including, 3.0.13. This makes it possible for unauthenticated attackers to reorder posts.
Product
The Ultimate WordPress Toolkit – WP Extended
Affected
up to 3.0.13
What to do
Affects up to 3.0.13. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 11, 2025aDirectory – WordPress Directory Listing: Unauthorized loss of dataCVE-2024-13541 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqs_delete_listing() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
Product
aDirectory – WordPress Directory Listing
Affected
up to 2.3
What to do
Affects up to 2.3. Update aDirectory – WordPress Directory Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2025AForms Eats: Full Path DisclosureCVE-2024-13539 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /vendor/aura/payload-interface/phpunit.php file being publicly accessible and displaying error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
AForms Eats
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update AForms Eats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2025WPGateway: Privilege escalationCVE-2022-3180 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts.
Product
WPGateway
Affected
up to 3.5
What to do
Affects up to 3.5. Update WPGateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Feb 11, 2025SuperSaaS – online appointment scheduling: Stored Cross-Site ScriptingCVE-2025-0862 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is limited to Chromium-based browsers (e.g. Chrome, Edge, Brave).
Product
SuperSaaS – online appointment scheduling
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update SuperSaaS – online appointment scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2025GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2024-13506 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Affected
up to 2.8.97
What to do
Affects up to 2.8.97. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2025Zox News - Professional WordPress News & Magazine: Unauthorized data modificationCVE-2024-13643 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks on the backup_options() and reset_options() functions in all versions up to and including 3.17.0. This vulnerability allows authenticated attackers with Subscriber-level access and above to update and delete arbitrary option values on the WordPress site. Attackers can exploit this issue to update the default user role for registration to Administrator and enable user registration, thereby gaining administrative access to the vulnerable site. Additionally, they could delete critical options, causing errors that may disrupt the site's functionality and deny service to legitimate users.
Product
Zox News - Professional WordPress News & Magazine
Affected
up to 3.17.0
What to do
Affects up to 3.17.0. Update Zox News - Professional WordPress News & Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mvpthemes.com themeforest.net
Feb 11, 2025WP Foodbakery: Privilege escalationCVE-2025-0181 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authentication cookie. This makes it possible for unauthenticated attackers to gain access to a target user's (e.g. administrators) account.
Product
WP Foodbakery
Affected
up to 4.8
What to do
Affects up to 4.8. Update WP Foodbakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 11, 2025WP Foodbakery: Privilege escalationCVE-2025-0180 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.
Product
WP Foodbakery
Affected
up to 4.7
What to do
Affects up to 4.7. Update WP Foodbakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 11, 2025Stray Random Quotes: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13570 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Stray Random Quotes
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update Stray Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 11, 2025Zarinpal Paid Download: Does not properly validate uploaded filesCVE-2024-13544 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
Zarinpal Paid Download
Affected
up to 2.3
What to do
Affects up to 2.3. Update Zarinpal Paid Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 11, 2025Zarinpal Paid Download: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Zarinpal Paid Download
Affected
up to 2.3
What to do
Affects up to 2.3. Update Zarinpal Paid Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 11, 2025HT Mega – Absolute Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-12599 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HT Mega – Absolute Addons For Elementor
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update HT Mega – Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 10, 2025WP Foodbakery: Arbitrary file uploadsCVE-2024-13011 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP Foodbakery
Affected
up to 4.7
What to do
Affects up to 4.7. Update WP Foodbakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 10, 2025WP Foodbakery: Reflected Cross-Site ScriptingCVE-2024-13010 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Foodbakery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on the 'search_type' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Foodbakery
Affected
up to 4.8
What to do
Affects up to 4.8. Update WP Foodbakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 9, 2025Super Store Finder: SQL InjectionCVE-2024-13440 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all versions up to, and including, 7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into an already existing query to store cross-site scripting in store reviews.
Product
Super Store Finder
Affected
up to 7.0
What to do
Affects up to 7.0. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record superstorefinder.net wordfence.com
Feb 8, 2025DWT - Directory & Listing: Stored Cross-Site ScriptingCVE-2025-0169 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DWT - Directory & Listing
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update DWT - Directory & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 8, 2025WP Directorybox Manager: Authentication bypassCVE-2025-0316 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Product
WP Directorybox Manager
Affected
up to 2.5
What to do
Affects up to 2.5. Update WP Directorybox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 8, 2025Simple add pages or posts: Stored Cross-Site ScriptingCVE-2024-13850 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Simple add pages or posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Simple add pages or posts
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Simple add pages or posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 7, 2025WP ALL Export Pro: Unauthorized modification of data that can lead to privilege escalationCVE-2024-7425 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input validation and sanitization in all versions up to, and including, 1.9.1. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WP ALL Export Pro
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update WP ALL Export Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 7, 2025WP All Import Pro: PHP Object InjectionCVE-2024-9664 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
WP All Import Pro
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 7, 2025WP All Import Pro: Cross-Site Request ForgeryCVE-2024-9661 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP All Import Pro
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 7, 2025WP ALL Export Pro: Remote Code ExecutionCVE-2024-7419 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation and sanitization of user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary PHP code into form fields that get executed on the server during the export, potentially leading to a complete site compromise. As a prerequisite, the custom export field should include fields containing user-supplied data.
Product
WP ALL Export Pro
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update WP ALL Export Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 7, 2025BookPress – For Book Authors: Cross-Site Request Forgery (CSRF)CVE-2025-25168 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Black and White BookPress – For Book Authors book-press allows Cross-Site Scripting (XSS).This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.
Product
BookPress – For Book Authors
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update BookPress – For Book Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025BookPress – For Book Authors: Missing AuthorizationCVE-2025-25167 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Black and White BookPress – For Book Authors book-press allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.
Product
BookPress – For Book Authors
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update BookPress – For Book Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025InLocation: Cross-Site Request Forgery (CSRF)CVE-2025-25166 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in gabrieldarezzo InLocation inlocation allows Stored XSS.This issue affects InLocation: from n/a through <= 1.8.
Product
InLocation
Affected
up to 1.8
What to do
Affects up to 1.8. Update InLocation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Plugin A/B Image Optimizer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-25163 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through <= 3.3.
Product
Plugin A/B Image Optimizer
Affected
up to 3.3
What to do
Affects up to 3.3. Update Plugin A/B Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Style Tweaker: Cross-Site Request Forgery (CSRF)CVE-2025-25160 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through <= 0.11.
Product
Style Tweaker
Affected
up to 0.11
What to do
Affects up to 0.11. Update Style Tweaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025WP doodlez: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25159 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robert_kolatzek WP doodlez wpdoodlez allows Stored XSS.This issue affects WP doodlez: from n/a through <= 1.0.10.
Product
WP doodlez
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update WP doodlez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Quote Comments: Cross-Site Request Forgery (CSRF)CVE-2025-25156 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Stanko Metodiev Quote Comments quote-comments allows Stored XSS.This issue affects Quote Comments: from n/a through <= 3.0.0.
Product
Quote Comments
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Quote Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Music Sheet Viewer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-25155 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in efreja Music Sheet Viewer music-sheet-viewer allows Path Traversal.This issue affects Music Sheet Viewer: from n/a through <= 4.1.
Product
Music Sheet Viewer
Affected
up to 4.1
What to do
Affects up to 4.1. Update Music Sheet Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Custom Comment Notifications: Cross-Site Request Forgery (CSRF)CVE-2025-25154 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in scweber Custom Comment Notifications custom-comment-notifications allows Stored XSS.This issue affects Custom Comment Notifications: from n/a through <= 1.0.8.
Product
Custom Comment Notifications
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Custom Comment Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Simple Auto Tag: Cross-Site Request Forgery (CSRF)CVE-2025-25153 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through <= 1.1.
Product
Simple Auto Tag
Affected
up to 1.1
What to do
Affects up to 1.1. Update Simple Auto Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Smart DoFollow: Cross-Site Request Forgery (CSRF)CVE-2025-25152 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow smart-dofollow allows Stored XSS.This issue affects Smart DoFollow: from n/a through <= 1.0.2.
Product
Smart DoFollow
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Smart DoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025uListing: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-25151 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows SQL Injection.This issue affects uListing: from n/a through <= 2.1.6.
Product
uListing
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Login-box: Cross-Site Request Forgery (CSRF)CVE-2025-25149 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box login-box allows Stored XSS.This issue affects Login-box: from n/a through <= 2.0.4.
Product
Login-box
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Login-box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Read More Copy Link: Cross-Site Request Forgery (CSRF)CVE-2025-25148 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ElbowRobo Read More Copy Link read-more-copy-link allows Stored XSS.This issue affects Read More Copy Link: from n/a through <= 1.0.2.
Product
Read More Copy Link
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Read More Copy Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Auto SEO: Cross-Site Request Forgery (CSRF)CVE-2025-25147 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through <= 2.5.6.
Product
Auto SEO
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Auto SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Songkick Concerts and Festivals: Cross-Site Request Forgery (CSRF)CVE-2025-25146 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in saleandro Songkick Concerts and Festivals songkick-concerts-and-festivals allows Cross Site Request Forgery.This issue affects Songkick Concerts and Festivals: from n/a through <= 0.9.7.
Product
Songkick Concerts and Festivals
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Songkick Concerts and Festivals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.