Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

3,904 results · page 45 of 79

Jan 15, 2025Contact Form 7 Redirect & Thank You Page: Reflected Cross-Site ScriptingCVE-2024-12423 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Contact Form 7 Redirect & Thank You Page
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Contact Form 7 Redirect & Thank You Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2025Piotnet Addons For Elementor: Information ExposureCVE-2024-10775 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Piotnet Addons For Elementor
Affected
up to 2.4.32
What to do
Affects up to 2.4.32. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2025W3 Total Cache: Information ExposureCVE-2024-12008 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks. Note: the debug feature must be enabled for this to be a concern, and it is disabled by default.
Product
W3 Total Cache
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 13, 2025Event Monster – Event Management, Tickets Booking, Upcoming Event: Information ExposureCVE-2024-11396 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.
Product
Event Monster – Event Management, Tickets Booking, Upcoming Event
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its form settingsCVE-2024-12567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Email Subscribers by Icegram Express
Fixed in
5.7.45
What to do
Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Full record and what to do →NVD record wpscan.com
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of form settingsCVE-2024-12566 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Email Subscribers by Icegram Express
Fixed in
5.7.45
What to do
Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Full record and what to do →NVD record wpscan.com
Jan 11, 2025GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-12877 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server that makes remote code execution possible. Please note this was only partially patched in 3.19.3, a fully sufficient patch was not released until 3.19.4. However, another CVE was assigned by another CNA for version 3.19.3 so we will leave this as affecting 3.19.2 and before. We have recommended the vendor use JSON encoding to prevent any further deserialization vulnerabilities from being present.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.19.2
What to do
Affects up to 3.19.2. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2025Unlimited Theme Addon For Elementor and WooCommerce: Information ExposureCVE-2024-12116 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Unlimited Theme Addon For Elementor and WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'uta-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Unlimited Theme Addon For Elementor and WooCommerce
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Unlimited Theme Addon For Elementor and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 11, 2025RRAddons for Elementor: Information ExposureCVE-2024-11915 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RRAddons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.0 via the Popup block due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.
Product
RRAddons for Elementor
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update RRAddons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 11, 2025GatorMail SmartForms: Stored Cross-Site ScriptingCVE-2024-11386 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GatorMail SmartForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gatormailsmartform' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GatorMail SmartForms
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update GatorMail SmartForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 11, 2025Contact Form Master: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12587 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Contact Form Master
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Contact Form Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 10, 2025Post Duplicator: Information ExposureCVE-2024-12472 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to by duplicating the post.
Product
Post Duplicator
Affected
up to 2.36
What to do
Affects up to 2.36. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025Conversational Forms for ChatBot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22813 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through <= 1.4.2.
Product
Conversational Forms for ChatBot
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Conversational Forms for ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025Advanced Product Information for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce woo-advanced-product-information allows Stored XSS.This issue affects Advanced Product Information for WooCommerce: from n/a through <= 1.1.4.
Product
Advanced Product Information for WooCommerce
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Advanced Product Information for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025wp Hosting Performance Check: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22521 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Farrell wp Hosting Performance Check wp-hosting-performance-check allows Reflected XSS.This issue affects wp Hosting Performance Check: from n/a through <= 2.18.8.
Product
wp Hosting Performance Check
Affected
up to 2.18.8
What to do
Affects up to 2.18.8. Update wp Hosting Performance Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 20254ECPS Web Forms: Unrestricted Upload of File with Dangerous TypeCVE-2025-22504 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms 4ecps-webforms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through <= 0.2.18.
Product
4ECPS Web Forms
Affected
up to 0.2.18
What to do
Affects up to 0.2.18. Update 4ECPS Web Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22295 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through <= 8.0.6.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.6
What to do
Affects up to 8.0.6. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025WP Database Backup – Unlimited Database & Files Backup by Backup for WP: Sensitive Information ExposureCVE-2024-12330 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database.
Product
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
Affected
up to 7.3
What to do
Affects up to 7.3. Update WP Database Backup – Unlimited Database & Files Backup by Backup for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025CLUEVO LMS, E-Learning Platform: Reflected Cross-Site ScriptingCVE-2024-11328 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.13.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CLUEVO LMS, E-Learning Platform
Affected
up to 1.13.2
What to do
Affects up to 1.13.2. Update CLUEVO LMS, E-Learning Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 8, 2025140+ Widgets | Xpro Addons For Elementor – FREE: Sensitive Information ExposureCVE-2024-12584 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6.2 via the 'duplicate' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.
Product
140+ Widgets | Xpro Addons For Elementor – FREE
Affected
up to 1.4.6.2
What to do
Affects up to 1.4.6.2. Update 140+ Widgets | Xpro Addons For Elementor – FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025SureForms – Drag and Drop Form Builder for: Information ExposureCVE-2024-12713 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to.
Product
SureForms – Drag and Drop Form Builder for
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder: Stored Cross-Site ScriptingCVE-2024-12112 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'add_form_Emsfb' AJAX action in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping and missing authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Link Whisper Free: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-22306 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Spencer Haws Link Whisper Free link-whisper.This issue affects Link Whisper Free: from n/a through <= 0.7.7.
Product
Link Whisper Free
Affected
up to 0.7.7
What to do
Affects up to 0.7.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Urdu Formatter – Shamil: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22531 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M Bilal M Urdu Formatter – Shamil urdu-formatter-shamil allows Stored XSS.This issue affects Urdu Formatter – Shamil: from n/a through <= 0.1.
Product
Urdu Formatter – Shamil
Affected
up to 0.1
What to do
Affects up to 0.1. Update Urdu Formatter – Shamil to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2024-12738 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.12.9
What to do
Affects up to 3.12.9. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025BWD Elementor Addons: Sensitive Information ExposureCVE-2024-12532 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
BWD Elementor Addons
Affected
up to 4.3.18
What to do
Affects up to 4.3.18. Update BWD Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for CVE-2024-11826 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Contact Form 7 Database – CFDB7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22351 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in penguinarts Contact Form 7 Database – CFDB7 advanced-cf7-database allows SQL Injection.This issue affects Contact Form 7 Database – CFDB7: from n/a through <= 1.0.0.
Product
Contact Form 7 Database – CFDB7
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Contact Form 7 Database – CFDB7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025BSK Forms Blacklist: Cross-Site Request Forgery (CSRF)CVE-2025-22347 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in bannersky BSK Forms Blacklist bsk-gravityforms-blacklist allows Blind SQL Injection.This issue affects BSK Forms Blacklist: from n/a through <= 3.9.
Product
BSK Forms Blacklist
Affected
up to 3.9
What to do
Affects up to 3.9. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP Mailster: Insertion of Sensitive Information Into Sent DataCVE-2025-22303 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
Product
WP Mailster
Affected
up to 1.8.17.0
What to do
Affects up to 1.8.17.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Post/Page Copying Tool: Insertion of Sensitive Information Into Sent DataCVE-2024-56300 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Retrieve Embedded Sensitive Data.This issue affects Post/Page Copying Tool: from n/a through <= 2.0.0.
Product
Post/Page Copying Tool
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Post/Page Copying Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Advanced Form Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56293 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Stored XSS.This issue affects Advanced Form Integration: from n/a through <= 1.95.0.
Product
Advanced Form Integration
Affected
up to 1.95.0
What to do
Affects up to 1.95.0. Update Advanced Form Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Contact Form by WPForms: Missing AuthorizationCVE-2024-56276 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.
Product
Contact Form by WPForms
Affected
up to 1.9.2.2
What to do
Affects up to 1.9.2.2. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025CubeWP Forms: Missing AuthorizationCVE-2024-51651 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.10.
Product
CubeWP Forms
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Passster – Password Protect Pages and Content: Sensitive Information ExposureCVE-2024-11282 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Passster – Password Protect Pages and Content
Affected
up to 4.2.10
What to do
Affects up to 4.2.10. Update Passster – Password Protect Pages and Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10562 · WordPress plugins & themes · reported by WPScanLow 2.7
The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Form Maker by 10Web
Fixed in
1.15.31
What to do
Update Form Maker by 10Web to 1.15.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 7, 2025Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords: Information ExposureCVE-2024-12159 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1 due to the print_php_information.php being publicly accessible. This makes it possible for unauthenticated attackers to extract sensitive configuration data that can be leveraged in another attack.
Product
Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords
Affected
up to 3.1
What to do
Affects up to 3.1. Update Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements: Information ExposureCVE-2024-12140 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render function due to insufficient restrictions on which templates can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft templates that they should not have access to.
Product
Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Member Access: Sensitive Information ExposureCVE-2024-11290 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Member Access plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Member Access
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Member Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 6, 2025Duplicate Post, Page and Any Custom Post: Sensitive Information ExposureCVE-2024-12538 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Duplicate Post, Page and Any Custom Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.5 via the 'dpp_duplicate_as_draft' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.
Product
Duplicate Post, Page and Any Custom Post
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Duplicate Post, Page and Any Custom Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 6, 2025The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler: Arbitrary shortcode executionCVE-2024-12419 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This functionality is also vulnerable to Reflected Cross-Site Scripting. Version 1.7.0 patched the Reflected XSS issue, however, the arbitrary shortcode execution issue remains.
Product
The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2025Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce: Stored Cross-Site ScriptingCVE-2024-11934 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' shortcode in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce
Affected
up to 2.1.3.2
What to do
Affects up to 2.1.3.2. Update Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 4, 2025WP Compress – Instant Performance & Speed Optimization: Reflected Cross-Site ScriptingCVE-2024-12047 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Compress – Instant Performance & Speed Optimization
Affected
up to 6.30.03
What to do
Affects up to 6.30.03. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025i-transform: Cross-Site Request Forgery (CSRF)CVE-2024-38764 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9.
Product
i-transform
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update i-transform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Swift Performance Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37511 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in swte Swift Performance Lite swift-performance-lite allows Cross Site Request Forgery.This issue affects Swift Performance Lite: from n/a through <= 2.3.6.20.
Product
Swift Performance Lite
Affected
up to 2.3.6.20
What to do
Affects up to 2.3.6.20. Update Swift Performance Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Ultimate Addons for Contact Form 7: Missing AuthorizationCVE-2023-47693 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.2.6.
Product
Ultimate Addons for Contact Form 7
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Flo Forms: Missing AuthorizationCVE-2023-47692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flo Forms: from n/a through <= 1.0.41.
Product
Flo Forms
Affected
up to 1.0.41
What to do
Affects up to 1.0.41. Update Flo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Quill Forms: Missing AuthorizationCVE-2023-46610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mohamed Magdy Quill Forms quillforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quill Forms: from n/a through <= 3.3.0.
Product
Quill Forms
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Quill Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025MW WP Form: Missing AuthorizationCVE-2023-46206 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Webの相談所 MW WP Form mw-wp-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MW WP Form: from n/a through <= 4.4.5.
Product
MW WP Form
Affected
up to 4.4.5
What to do
Affects up to 4.4.5. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Kali Forms: Missing AuthorizationCVE-2023-46083 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.27.
Product
Kali Forms
Affected
up to 2.3.27
What to do
Affects up to 2.3.27. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.