Updated 50 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

490new WordPress flaws this week

397,270entries in the database

41,266 results · page 436 of 826

Jan 22, 2025Mapbox for WP Advanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22772 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stephanemartinw Mapbox for WP Advanced mapbox-for-wp-advanced allows Reflected XSS.This issue affects Mapbox for WP Advanced: from n/a through <= 1.0.0.
Product
Mapbox for WP Advanced
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Mapbox for WP Advanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Arbitrary shortcode executionCVE-2024-13499 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_do_shortcode() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Time-based SQL InjectionCVE-2024-13496 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was previously published as being fixed in version 7.2.2 which was incorrect. The correct fixed version is 7.3.2.
Product
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.3.1
Fixed in
7.2.2
What to do
Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to 7.2.2 or newer.
Full record and what to do →NVD record abrahack.com plugins.trac.wordpress.org
Jan 22, 2025The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Arbitrary shortcode executionCVE-2024-13495 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipress_ajax_get_logs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025WP Hotel Booking: Unauthorized access of dataCVE-2024-13447 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a list of registered user emails.
Product
WP Hotel Booking
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025AI Power: Complete AI Pack: PHP Object InjectionCVE-2025-0429 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_ai_forms() function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AI Power: Complete AI Pack: PHP Object InjectionCVE-2025-0428 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_prompts function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AI Power: Complete AI Pack: Unauthorized accessCVE-2024-13361 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_save_image_media function in all versions up to, and including, 1.8.96. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload image files and embed shortcode attributes in the image_alt value that will execute when sending a POST request to the attachment page.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AI Power: Complete AI Pack: Server-Side Request ForgeryCVE-2024-13360 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicg_troubleshoot_add_vector(). This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025Themify Builder: Reflected Cross-Site ScriptingCVE-2024-13319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Themify Builder
Affected
up to 7.6.5
What to do
Affects up to 7.6.5. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025XML for Google Merchant Center: Reflected Cross-Site ScriptingCVE-2024-13406 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
XML for Google Merchant Center
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update XML for Google Merchant Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025AdForest: Authentication bypassCVE-2024-12857 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as any user as long as they have configured OTP login by phone number.
Product
AdForest
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 22, 2025Stackable – Page Builder Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2024-12117 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the Button block in all versions up to, and including, 3.13.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Stackable – Page Builder Gutenberg Blocks
Affected
up to 3.13.11
What to do
Affects up to 3.13.11. Update Stackable – Page Builder Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2025WPBot Pro Wordpress Chatbot: Unauthorized modification of dataCVE-2024-12879 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qc_wp_latest_update_check_pro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create Simple Text Responses to chat queries.
Product
WPBot Pro Wordpress Chatbot
Affected
up to 13.5.5
What to do
Affects up to 13.5.5. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbot.pro
Jan 21, 2025Ketchup Shortcodes: Stored Cross-Site ScriptingCVE-2024-13590 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ketchup Shortcodes
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update Ketchup Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 21, 2025Picture Gallery – Frontend Image Uploads, AJAX Photo List: Stored Cross-Site ScriptingCVE-2024-13584 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Picture Gallery – Frontend Image Uploads, AJAX Photo List
Affected
up to 1.5.19
What to do
Affects up to 1.5.19. Update Picture Gallery – Frontend Image Uploads, AJAX Photo List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 21, 2025WP-Polls: SQL InjectionCVE-2024-13426 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries. Those queries are stored and results are not displayed to the attacker, which means they cannot be exploited to obtain any additional information about the database. However, a properly configured payload allows for the injection of malicious JavaScript resulting in Stored Cross-Site Scripting.
Product
WP-Polls
Affected
up to 2.77.2
What to do
Affects up to 2.77.2. Update WP-Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 21, 2025WPBot Pro Wordpress Chatbot: Arbitrary file uploadsCVE-2024-13091 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload' function in all versions up to, and including, 13.5.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit requires thee ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin.
Product
WPBot Pro Wordpress Chatbot
Affected
up to 13.5.4
What to do
Affects up to 13.5.4. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbot.pro
Jan 21, 2025AnyRoad: Cross-Site Request Forgery (CSRF)CVE-2025-23996 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AnyRoad AnyRoad anyguide allows Cross Site Request Forgery.This issue affects AnyRoad: from n/a through <= 1.3.2.
Product
AnyRoad
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update AnyRoad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Estatebud – Properties & Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23994 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings estatebud-properties-listings allows Stored XSS.This issue affects Estatebud – Properties & Listings: from n/a through <= 5.5.0.
Product
Estatebud – Properties & Listings
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Estatebud – Properties & Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025BizLibrary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23580 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew BizLibrary bizlibrary allows Reflected XSS.This issue affects BizLibrary: from n/a through <= 1.1.
Product
BizLibrary
Affected
up to 1.1
What to do
Affects up to 1.1. Update BizLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025SexBundle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23551 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp SexBundle sexbundle allows Reflected XSS.This issue affects SexBundle: from n/a through <= 1.4.
Product
SexBundle
Affected
up to 1.4
What to do
Affects up to 1.4. Update SexBundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025WP-Announcements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23489 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner WP-Announcements wp-announcements allows Reflected XSS.This issue affects WP-Announcements: from n/a through <= 1.8.
Product
WP-Announcements
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP-Announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Realty Workstation: Missing AuthorizationCVE-2025-23477 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through <= 1.0.45.
Product
Realty Workstation
Affected
up to 1.0.45
What to do
Affects up to 1.0.45. Update Realty Workstation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Social2Blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23461 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xkollsoftware Social2Blog social2blog allows Reflected XSS.This issue affects Social2Blog: from n/a through <= 0.2.990.
Product
Social2Blog
Affected
up to 0.2.990
What to do
Affects up to 0.2.990. Update Social2Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Nature FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23454 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flashmaniac Nature FlipBook vertical-diamond-flipbook-flash allows Reflected XSS.This issue affects Nature FlipBook: from n/a through <= 1.7.
Product
Nature FlipBook
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nature FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Widget Options: Missing AuthorizationCVE-2025-22722 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8.
Product
Widget Options
Affected
up to 4.0.8
What to do
Affects up to 4.0.8. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025ApplyOnline: Missing AuthorizationCVE-2025-22721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Farhan Noor ApplyOnline apply-online allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline: from n/a through <= 2.6.7.1.
Product
ApplyOnline
Affected
up to 2.6.7.1
What to do
Affects up to 2.6.7.1. Update ApplyOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Online Payments – Get Paid with PayPal, Square & Stripe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22661 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Payments – Get Paid with PayPal, Square & Stripe paypal-payment-button-by-vcita allows Stored XSS.This issue affects Online Payments – Get Paid with PayPal, Square & Stripe: from n/a through <= 3.20.0.
Product
Online Payments – Get Paid with PayPal, Square & Stripe
Affected
up to 3.20.0
What to do
Affects up to 3.20.0. Update Online Payments – Get Paid with PayPal, Square & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Related Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22276 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enguerranws Related Post Shortcode related-post-shortcode allows Stored XSS.This issue affects Related Post Shortcode: from n/a through <= 1.2.
Product
Related Post Shortcode
Affected
up to 1.2
What to do
Affects up to 1.2. Update Related Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Weaver Themes Shortcode Compatibility: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22267 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Themes Shortcode Compatibility weaver-themes-shortcode-compatibility allows Stored XSS.This issue affects Weaver Themes Shortcode Compatibility: from n/a through <= 1.0.4.
Product
Weaver Themes Shortcode Compatibility
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Weaver Themes Shortcode Compatibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025PPO Call To Actions: Cross-Site Request Forgery (CSRF)CVE-2025-24001 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through <= 0.1.3.
Product
PPO Call To Actions
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update PPO Call To Actions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025UltraLight: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23998 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in raratheme UltraLight the-ultralight allows Reflected XSS.This issue affects UltraLight: from n/a through <= 1.2.
Product
UltraLight
Affected
up to 1.2
What to do
Affects up to 1.2. Update UltraLight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Tamara Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23997 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tamara Solution Tamara Checkout tamara-checkout allows Stored XSS.This issue affects Tamara Checkout: from n/a through < 1.9.9.1.
Product
Tamara Checkout
What to do
Update Tamara Checkout to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Flexible PDF Coupons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22825 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through < 1.10.3.
Product
Flexible PDF Coupons
What to do
Update Flexible PDF Coupons to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Brizy Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affects Brizy Pro: from n/a through 2.6.1.
Product
Brizy Pro
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Brizy Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025WordPress Tag Cloud Plugin – Tag Groups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22735 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-groups allows Reflected XSS.This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through <= 2.0.4.
Product
WordPress Tag Cloud Plugin – Tag Groups
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update WordPress Tag Cloud Plugin – Tag Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025My auctions allegro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22733 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.18.
Product
My auctions allegro
Affected
up to 3.6.18
What to do
Affects up to 3.6.18. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Ad Blocking Detector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22732 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Admiral Ad Blocking Detector ad-blocking-detector allows Stored XSS.This issue affects Ad Blocking Detector: from n/a through <= 3.6.0.
Product
Ad Blocking Detector
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Ad Blocking Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025MailChimp Subscribe Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22727 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps MailChimp Subscribe Forms mailchimp-subscribe-sm allows Stored XSS.This issue affects MailChimp Subscribe Forms : from n/a through <= 4.1.
Product
MailChimp Subscribe Forms
Affected
up to 4.1
What to do
Affects up to 4.1. Update MailChimp Subscribe Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Barcode Scanner with Inventory & Order Manager: Unrestricted Upload of File with Dangerous TypeCVE-2025-22723 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Upload a Web Shell to a Web Server.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.7.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025VikAppointments Services Booking Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22719 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikAppointments Services Booking Calendar vikappointments allows Stored XSS.This issue affects VikAppointments Services Booking Calendar: from n/a through <= 1.2.16.
Product
VikAppointments Services Booking Calendar
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update VikAppointments Services Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025FAT Event Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22718 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Event Lite fat-event-lite allows Stored XSS.This issue affects FAT Event Lite: from n/a through <= 1.1.
Product
FAT Event Lite
Affected
up to 1.1
What to do
Affects up to 1.1. Update FAT Event Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025My Tickets: Missing AuthorizationCVE-2025-22717 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My Tickets: from n/a through <= 2.0.9.
Product
My Tickets
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Taskbuilder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22716 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows SQL Injection.This issue affects Taskbuilder: from n/a through <= 3.0.6.
Product
Taskbuilder
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update Taskbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Image Source Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22711 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Maier Image Source Control image-source-control-isc allows Reflected XSS.This issue affects Image Source Control: from n/a through <= 2.29.0.
Product
Image Source Control
Affected
up to 2.29.0
What to do
Affects up to 2.29.0. Update Image Source Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Smart Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22710 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through <= 8.52.0.
Product
Smart Manager
Affected
up to 8.52.0
What to do
Affects up to 8.52.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Verge3D: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22709 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.8.0.
Product
Verge3D
Affected
up to 4.8.0
What to do
Affects up to 4.8.0. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Social Pug: Author Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22706 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0.
Product
Social Pug: Author Box
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Social Pug: Author Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Multiple Carousel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22553 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in dhananjaysingh Multiple Carousel multicarousel allows SQL Injection.This issue affects Multiple Carousel: from n/a through <= 2.0.
Product
Multiple Carousel
Affected
up to 2.0
What to do
Affects up to 2.0. Update Multiple Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.