Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,266 results · page 437 of 826
Jan 21, 2025Private Messages for UserPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging allows Reflected XSS.This issue affects Private Messages for UserPro: from n/a through <= 4.10.0.
- Product
- Private Messages for UserPro
- Affected
- up to 4.10.0
- What to do
- Affects up to 4.10.0. Update Private Messages for UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Standard Box Sizes – for WooCommerce: Missing AuthorizationCVE-2025-22318 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for WooCommerce: from n/a through <= 1.6.13.
- Product
- Standard Box Sizes – for WooCommerce
- Affected
- up to 1.6.13
- What to do
- Affects up to 1.6.13. Update Standard Box Sizes – for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Private Messages for UserPro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22311 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging.This issue affects Private Messages for UserPro: from n/a through <= 4.10.0.
- Product
- Private Messages for UserPro
- Affected
- up to 4.10.0
- What to do
- Affects up to 4.10.0. Update Private Messages for UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Bonjour Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22262 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WittyFolk Bonjour Bar bonjour-bar allows Stored XSS.This issue affects Bonjour Bar: from n/a through <= 1.0.0.
- Product
- Bonjour Bar
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Bonjour Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Poll Maker: Improper Encoding or Escaping of OutputCVE-2024-56277 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Encoding or Escaping of Output vulnerability in Ays Pro Poll Maker poll-maker.This issue affects Poll Maker: from n/a through < 5.5.5.
- Product
- Poll Maker
- Fixed in
- 5.5.5
- What to do
- Update Poll Maker to 5.5.5 or newer.
Jan 21, 2025Fancy Product Designer: Unrestricted Upload of File with Dangerous TypeCVE-2024-51919 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.
- Product
- Fancy Product Designer
- Affected
- up to 6.4.3
- What to do
- Affects up to 6.4.3. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Homey Login Register: Incorrect Privilege AssignmentCVE-2024-51888 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login Register: from n/a through <= 2.4.0.
- Product
- Homey Login Register
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Homey Login Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Fancy Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51818 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.
- Product
- Fancy Product Designer
- Affected
- up to 6.4.3
- What to do
- Affects up to 6.4.3. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Reflected XSS.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49699 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49688 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49666 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49655 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Hero Mega Menu - Responsive WordPress Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49333 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.
- Product
- Hero Mega Menu - Responsive WordPress Menu
- Affected
- up to 1.16.5
- What to do
- Affects up to 1.16.5. Update Hero Mega Menu - Responsive WordPress Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Hero Mega Menu - Responsive WordPress Menu: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49303 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.
- Product
- Hero Mega Menu - Responsive WordPress Menu
- Affected
- up to 1.16.5
- What to do
- Affects up to 1.16.5. Update Hero Mega Menu - Responsive WordPress Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Hero Mega Menu - Responsive WordPress Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49300 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows Reflected XSS. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.
- Product
- Hero Mega Menu - Responsive WordPress Menu
- Affected
- up to 1.16.5
- What to do
- Affects up to 1.16.5. Update Hero Mega Menu - Responsive WordPress Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Easy Real Estate: Incorrect Privilege AssignmentCVE-2024-32555 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in InspiryThemes Easy Real Estate easy-real-estate allows Privilege Escalation.This issue affects Easy Real Estate: from n/a through <= 2.2.9.
- Product
- Easy Real Estate
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Easy Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Betheme: Stored Cross-Site ScriptingCVE-2025-0450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Betheme
- Affected
- up to 27.6.1
- What to do
- Affects up to 27.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsupport.muffingroup.comwordfence.com
Jan 21, 2025wp-greet: Cross-Site Request ForgeryCVE-2024-13444 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The wp-greet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- wp-greet
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update wp-greet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 21, 2025Social Share, Social Login and Social Comments Plugin – Super Socializer: Limited SQL InjectionCVE-2024-13230 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional values into the already existing query that can be used to extract user metadata from the database.
- Product
- Social Share, Social Login and Social Comments Plugin – Super Socializer
- Affected
- up to 7.14
- What to do
- Affects up to 7.14. Update Social Share, Social Login and Social Comments Plugin – Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 21, 2025FireCask Like & Share Button: Stored Cross-Site ScriptingCVE-2024-11226 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- FireCask Like & Share Button
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update FireCask Like & Share Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 21, 2025Link Library: Reflected Cross-Site ScriptingCVE-2024-13404 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Link Library
- Affected
- up to 7.7.2
- What to do
- Affects up to 7.7.2. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 21, 2025Visual Website Collaboration, Feedback & Project Management – Atarim: Unauthorized loss of dataCVE-2024-12104 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpf_delete_file and wpf_delete_file functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attackers to delete project pages and files. CVE-2025-22657 may be a duplicate of this issue.
- Product
- Visual Website Collaboration, Feedback & Project Management – Atarim
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 21, 2025WP-BibTeX: Cross-Site Request ForgeryCVE-2024-12005 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP-BibTeX
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update WP-BibTeX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 21, 2025JetElements: Stored Cross-Site ScriptingCVE-2025-0371 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- JetElements
- Affected
- up to 2.7.2.1
- What to do
- Affects up to 2.7.2.1. Update JetElements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcrocoblock.comwordfence.com
Jan 21, 2025String locator: PHP Object InjectionCVE-2024-10936 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must perform a search and replace action to trigger the exploit.
- Product
- String locator
- Affected
- up to 2.6.6
- What to do
- Affects up to 2.6.6. Update String locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 21, 20251003 Mortgage Application: Full Path DisclosureCVE-2024-13536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class/fnm/export.php file being publicly accessible with error logging enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 19, 2025Import any XML or CSV File to WordPress PRO: Stored Cross-Site ScriptingCVE-2024-8722 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Import any XML or CSV File to WordPress PRO
- Affected
- up to 4.9.7
- What to do
- Affects up to 4.9.7. Update Import any XML or CSV File to WordPress PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwpallimport.com
Jan 18, 2025Adifier System: Privilege escalationCVE-2024-13375 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This is due to the plugin not properly validating a user's identity prior to updating their details like password through the adifier_recover() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- Adifier System
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Adifier System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jan 18, 2025The Ultimate WordPress Toolkit – WP Extended: Time-based SQL InjectionCVE-2024-13184 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions up to, and including, 3.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- The Ultimate WordPress Toolkit – WP Extended
- Affected
- up to 3.0.12
- What to do
- Affects up to 3.0.12. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 18, 2025Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings: Stored Cross-Site ScriptingCVE-2024-13392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_reviews' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025Buzz Club – Night Club, DJ and Music Festival Event: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-0515 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
- Product
- Buzz Club – Night Club, DJ and Music Festival Event
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Buzz Club – Night Club, DJ and Music Festival Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jan 18, 2025JetEngine: Stored Cross-Site ScriptingCVE-2025-0369 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘list_tag’ parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- JetEngine
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcrocoblock.comcrocoblock.com
Jan 18, 2025MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution: Stored Cross-Site ScriptingCVE-2024-13519 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.9.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
- Affected
- up to 1.9.80
- What to do
- Affects up to 1.9.80. Update MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Stored Cross-Site ScriptingCVE-2024-13517 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025Utilities for MTG: Stored Cross-Site ScriptingCVE-2024-13433 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Utilities for MTG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Utilities for MTG
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Utilities for MTG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 18, 2025Webcamconsult: Cross-Site Request ForgeryCVE-2024-13432 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Webcamconsult plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Webcamconsult
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Webcamconsult to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025Video Share VOD – Turnkey Video Site Builder Script: Stored Cross-Site ScriptingCVE-2024-13393 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_videos' shortcode in all versions up to, and including, 2.6.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Video Share VOD – Turnkey Video Site Builder Script
- Affected
- up to 2.6.31
- What to do
- Affects up to 2.6.31. Update Video Share VOD – Turnkey Video Site Builder Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet: Stored Cross-Site ScriptingCVE-2024-13391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet
- Affected
- up to 2.9.29
- What to do
- Affects up to 2.9.29. Update MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025JSM Screenshot Machine Shortcode: Stored Cross-Site ScriptingCVE-2024-13385 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JSM Screenshot Machine Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ssm' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- JSM Screenshot Machine Shortcode
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update JSM Screenshot Machine Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 18, 2025ShipWorks Connector for Woocommerce: Cross-Site Request ForgeryCVE-2024-13317 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ShipWorks Connector for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5. This is due to missing or incorrect nonce validation on the 'shipworks-wordpress' page. This makes it possible for unauthenticated attackers to update the services username and password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ShipWorks Connector for Woocommerce
- Affected
- up to 5.2.5
- What to do
- Affects up to 5.2.5. Update ShipWorks Connector for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025Picture Gallery – Frontend Image Uploads, AJAX Photo List: Stored Cross-Site ScriptingCVE-2024-12696 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisper_picture_upload_guest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Picture Gallery – Frontend Image Uploads, AJAX Photo List
- Affected
- up to 1.5.22
- What to do
- Affects up to 1.5.22. Update Picture Gallery – Frontend Image Uploads, AJAX Photo List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 18, 2025WP Abstracts: Cross-Site Request ForgeryCVE-2024-12385 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing nonce validation on the wpabstracts_load_status() and wpabstracts_delete_abstracts() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Abstracts
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 18, 2025Podlove Podcast Publisher: Stored Cross-Site ScriptingCVE-2025-0554 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Information ExposureCVE-2025-0318 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.9.1 through different error messages in the responses. This makes it possible for unauthenticated attackers to exfiltrate data from wp_usermeta table.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Time-based SQL InjectionCVE-2025-0308 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025List category posts: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-9020 · WordPress plugins & themes · reported by WPScanMedium 5.4
The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- List category posts
- Fixed in
- 0.90.3
- What to do
- Update List category posts to 0.90.3 or newer.
Jan 18, 2025Kubio AI Page Builder: Reflected Cross-Site ScriptingCVE-2024-13516 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Kubio AI Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Kubio AI Page Builder
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025Image Source Control Lite – Show Image Credits and Captions: Reflected Cross-Site ScriptingCVE-2024-13515 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'path' parameter in all versions up to, and including, 2.28.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Image Source Control Lite – Show Image Credits and Captions
- Affected
- up to 2.28.0
- What to do
- Affects up to 2.28.0. Update Image Source Control Lite – Show Image Credits and Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 17, 2025Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media: Unauthorized loss of dataCVE-2024-12071 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_network_post() function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages.
- Product
- Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.