Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,262 results · page 432 of 826
Jan 24, 2025Admin and Site Enhancements (ASE): Missing AuthorizationCVE-2025-24649 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.
- Product
- Admin and Site Enhancements (ASE)
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WooCommerce Cloak Affiliate Links: Cross-Site Request Forgery (CSRF)CVE-2025-24647 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in datafeedr WooCommerce Cloak Affiliate Links woocommerce-cloak-affiliate-links allows Cross Site Request Forgery.This issue affects WooCommerce Cloak Affiliate Links: from n/a through <= 1.0.35.
- Product
- WooCommerce Cloak Affiliate Links
- Affected
- up to 1.0.35
- What to do
- Affects up to 1.0.35. Update WooCommerce Cloak Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24644 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce allows Stored XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through <= 4.7.1.
- Product
- WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Create with Code: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24638 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through <= 1.4.
- Product
- Create with Code
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Create with Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025MachForm Shortcode: Cross-Site Request Forgery (CSRF)CVE-2025-24636 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Rick Laymance MachForm Shortcode machform-shortcode allows Stored XSS.This issue affects MachForm Shortcode: from n/a through <= 1.4.1.
- Product
- MachForm Shortcode
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update MachForm Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Orbisius Simple Notice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24634 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Svetoslav Marinov Orbisius Simple Notice orbisius-simple-notice allows Stored XSS.This issue affects Orbisius Simple Notice: from n/a through <= 1.1.3.
- Product
- Orbisius Simple Notice
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Orbisius Simple Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Build Private Store For Woocommerce: Missing AuthorizationCVE-2025-24633 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Build Private Store For Woocommerce: from n/a through <= 1.0.
- Product
- Build Private Store For Woocommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Build Private Store For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Blur Text: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24627 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linnea Huxford Blur Text blur-text allows Stored XSS.This issue affects Blur Text: from n/a through <= 1.0.0.
- Product
- Blur Text
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Blur Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Taxonomy/Term and Role based Discounts for WooCommerce: Missing AuthorizationCVE-2025-24625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through <= 5.1.
- Product
- Taxonomy/Term and Role based Discounts for WooCommerce
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update Taxonomy/Term and Role based Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Really Simple SSL: Cross-Site Request Forgery (CSRF)CVE-2025-24623 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Cross Site Request Forgery.This issue affects Really Simple SSL: from n/a through <= 9.1.4.
- Product
- Really Simple SSL
- Affected
- up to 9.1.4
- What to do
- Affects up to 9.1.4. Update Really Simple SSL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Job Board Manager: Cross-Site Request Forgery (CSRF)CVE-2025-24622 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Job Board Manager job-board-manager allows Cross Site Request Forgery.This issue affects Job Board Manager: from n/a through <= 2.1.59.
- Product
- Job Board Manager
- Affected
- up to 2.1.59
- What to do
- Affects up to 2.1.59. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025ElementInvader Addons for Elementor: Missing AuthorizationCVE-2025-24618 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.1.
- Product
- ElementInvader Addons for Elementor
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025FV Thoughtful Comments: Missing AuthorizationCVE-2025-24613 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FolioVision FV Thoughtful Comments thoughtful-comments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Thoughtful Comments: from n/a through <= 0.3.5.
- Product
- FV Thoughtful Comments
- Affected
- up to 0.3.5
- What to do
- Affects up to 0.3.5. Update FV Thoughtful Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP Ultimate Exporter: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-24611 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows Absolute Path Traversal.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.
- Product
- WP Ultimate Exporter
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update WP Ultimate Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Restrict Anonymous Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1.2.
- Product
- Restrict Anonymous Access
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Restrict Anonymous Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025VPSUForm: Missing AuthorizationCVE-2025-24604 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.0.5.
- Product
- VPSUForm
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WooCommerce Product Table Lite: Missing AuthorizationCVE-2025-24596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Table Lite: from n/a through <= 3.8.7.
- Product
- WooCommerce Product Table Lite
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025All Embed – Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24595 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons all-embed-addons-for-elementor allows Stored XSS.This issue affects All Embed – Elementor Addons: from n/a through <= 1.1.3.
- Product
- All Embed – Elementor Addons
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update All Embed – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Linet ERP-Woocommerce Integration: Missing AuthorizationCVE-2025-24594 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.7.
- Product
- Linet ERP-Woocommerce Integration
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-24591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.
- Product
- GDPR CCPA Compliance Support
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025JSM Show Post Metadata: Missing AuthorizationCVE-2025-24589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through <= 4.6.0.
- Product
- JSM Show Post Metadata
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update JSM Show Post Metadata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Patreon: Missing AuthorizationCVE-2025-24588 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through <= 1.9.1.
- Product
- Patreon
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Patreon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Email Subscription Popup: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24587 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.
- Product
- Email Subscription Popup
- Affected
- up to 1.2.23
- What to do
- Affects up to 1.2.23. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.7.
- Product
- Event post
- Affected
- up to 5.9.7
- What to do
- Affects up to 5.9.7. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 202512 Step Meeting List: Insertion of Sensitive Information Into Sent DataCVE-2025-24582 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
- Product
- 12 Step Meeting List
- Affected
- up to 3.16.5
- What to do
- Affects up to 3.16.5. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 202512 Step Meeting List: Missing AuthorizationCVE-2025-24580 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
- Product
- 12 Step Meeting List
- Affected
- up to 3.16.5
- What to do
- Affects up to 3.16.5. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Nested Pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24579 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages wp-nested-pages allows Stored XSS.This issue affects Nested Pages: from n/a through <= 3.2.9.
- Product
- Nested Pages
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025ElementInvader Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24578 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.0.
- Product
- ElementInvader Addons for Elementor
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025HelloAsso: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24575 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso allows Stored XSS.This issue affects HelloAsso: from n/a through <= 1.1.11.
- Product
- HelloAsso
- Affected
- up to 1.1.11
- What to do
- Affects up to 1.1.11. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025PageLayer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softaculous PageLayer pagelayer allows DOM-Based XSS.This issue affects PageLayer: from n/a through <= 1.9.4.
- Product
- PageLayer
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP Fast Total Search: Cross-Site Request Forgery (CSRF)CVE-2025-24572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.
- Product
- WP Fast Total Search
- Affected
- up to 1.78.258
- What to do
- Affects up to 1.78.258. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP Fast Total Search: Missing AuthorizationCVE-2025-24571 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.
- Product
- WP Fast Total Search
- Affected
- up to 1.78.258
- What to do
- Affects up to 1.78.258. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Atarim: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Stored XSS.This issue affects Atarim: from n/a through <= 4.0.8.
- Product
- Atarim
- Affected
- up to 4.0.8
- What to do
- Affects up to 4.0.8. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Starter Templates: Cross-Site Request Forgery (CSRF)CVE-2025-24568 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates astra-sites allows Cross Site Request Forgery.This issue affects Starter Templates: from n/a through <= 4.4.9.
- Product
- Starter Templates
- Affected
- up to 4.4.9
- What to do
- Affects up to 4.4.9. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025KBucket: Cross-Site Request Forgery (CSRF)CVE-2025-24562 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Optimal Access KBucket kbucket allows Stored XSS.This issue affects KBucket: from n/a through <= 4.1.6.
- Product
- KBucket
- Affected
- up to 4.1.6
- What to do
- Affects up to 4.1.6. Update KBucket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025ReviewsTap: Cross-Site Request Forgery (CSRF)CVE-2025-24561 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in awcode ReviewsTap reviewstap allows Stored XSS.This issue affects ReviewsTap: from n/a through <= 1.1.2.
- Product
- ReviewsTap
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update ReviewsTap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Subscription DNA: Cross-Site Request Forgery (CSRF)CVE-2025-24555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in subscriptiondna Subscription DNA subscriptiondna allows Stored XSS.This issue affects Subscription DNA: from n/a through <= 2.1.
- Product
- Subscription DNA
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Subscription DNA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Paytium: Generation of Error Message Containing Sensitive InformationCVE-2025-24552 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Generation of Error Message Containing Sensitive Information vulnerability in paytiumsupport Paytium paytium allows Retrieve Embedded Sensitive Data.This issue affects Paytium: from n/a through <= 4.4.11.
- Product
- Paytium
- Affected
- up to 4.4.11
- What to do
- Affects up to 4.4.11. Update Paytium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Caching Compatible Cookie Opt-In and JavaScript: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24547 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthias.wagner Caching Compatible Cookie Opt-In and JavaScript caching-compatible-cookie-optin-and-javascript allows Stored XSS.This issue affects Caching Compatible Cookie Opt-In and JavaScript: from n/a through <= 0.0.10.
- Product
- Caching Compatible Cookie Opt-In and JavaScript
- Affected
- up to 0.0.10
- What to do
- Affects up to 0.0.10. Update Caching Compatible Cookie Opt-In and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Ultimate Coming Soon & Maintenance: Cross-Site Request Forgery (CSRF)CVE-2025-24546 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in RSTheme Ultimate Coming Soon & Maintenance ultimate-coming-soon allows Cross Site Request Forgery.This issue affects Ultimate Coming Soon & Maintenance: from n/a through <= 1.0.9.
- Product
- Ultimate Coming Soon & Maintenance
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Ultimate Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Ultimate Coming Soon & Maintenance: Cross-Site Request Forgery (CSRF)CVE-2025-24543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RSTheme Ultimate Coming Soon & Maintenance ultimate-coming-soon allows Cross Site Request Forgery.This issue affects Ultimate Coming Soon & Maintenance: from n/a through <= 1.0.9.
- Product
- Ultimate Coming Soon & Maintenance
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Ultimate Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Icegram: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24542 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram icegram allows Stored XSS.This issue affects Icegram: from n/a through <= 3.1.31.
- Product
- Icegram
- Affected
- up to 3.1.31
- What to do
- Affects up to 3.1.31. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Product Size Charts Plugin for WooCommerce: Missing AuthorizationCVE-2025-23991 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dotstore Product Size Charts Plugin for WooCommerce woo-advanced-product-size-chart.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through <= 2.4.5.
- Product
- Product Size Charts Plugin for WooCommerce
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Product Size Charts Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Jobify - Job Board: Unauthorized access and modification of dataCVE-2024-13698 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_ai' and 'generate_image_via_ai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload files in an image format, and to generate AI images using the site's OpenAI key.
- Product
- Jobify - Job Board
- Affected
- up to 4.2.7
- What to do
- Affects up to 4.2.7. Update Jobify - Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jan 24, 2025Activity Plus Reloaded for BuddyPress: Blind Server-Side Request ForgeryCVE-2024-11913 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Activity Plus Reloaded for BuddyPress
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Activity Plus Reloaded for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 24, 2025RomethemeKit For Elementor: Sensitive Information ExposureCVE-2024-10324 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
- Product
- RomethemeKit For Elementor
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update RomethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 24, 2025FooGallery Captions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23889 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten FooGallery Captions foogallery-captions allows Reflected XSS.This issue affects FooGallery Captions: from n/a through <= 1.0.2.
- Product
- FooGallery Captions
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update FooGallery Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Custom Page Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23888 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Custom Page Extensions custom-page-extensions allows Reflected XSS.This issue affects Custom Page Extensions: from n/a through <= 0.6.
- Product
- Custom Page Extensions
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update Custom Page Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025MJ Contact us: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23885 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anildhiman MJ Contact us mj-contact-us allows Reflected XSS.This issue affects MJ Contact us: from n/a through <= 5.2.3.
- Product
- MJ Contact us
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update MJ Contact us to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Sticky Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23839 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asif Shakeel Sticky Button sticky-chat-button allows Stored XSS.This issue affects Sticky Button: from n/a through <= 1.0.
- Product
- Sticky Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Sticky Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.