Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

4,962 results · page 47 of 100

May 31, 2025Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder: Stored Cross-Site ScriptingCVE-2025-5292 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content’ parameter in all versions up to, and including, 5.11.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder
Affected
up to 5.11.2
What to do
Affects up to 5.11.2. Update Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 31, 2025Product Subtitle for WooCommerce: Stored Cross-Site ScriptingCVE-2025-5285 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Product Subtitle for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmlTag’ parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Product Subtitle for WooCommerce
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Product Subtitle for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 31, 2025FastSpring: Stored Cross-Site ScriptingCVE-2025-4595 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog' block in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on the 'color' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FastSpring
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update FastSpring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
May 31, 2025Daisycon prijsvergelijkers: Stored Cross-Site ScriptingCVE-2025-4590 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisycon_uitvaart' shortcode in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Daisycon prijsvergelijkers
Affected
up to 4.9.0
What to do
Affects up to 4.9.0. Update Daisycon prijsvergelijkers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 31, 2025Relevanssi – A Better Search: Stored Cross-Site ScriptingCVE-2025-5016 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 (Free) and 2.27.6 (Premium) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Relevanssi – A Better Search
Affected
up to 4.24.5
What to do
Affects up to 4.24.5. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 30, 2025LA-Studio Element Kit for Elementor: Stored Cross-Site ScriptingCVE-2025-4944 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widgets in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 30, 2025OpenSheetMusicDisplay: Stored Cross-Site ScriptingCVE-2025-5235 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
OpenSheetMusicDisplay
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update OpenSheetMusicDisplay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 30, 2025NinjaTeam Chat for Telegram: Stored Cross-Site ScriptingCVE-2025-5236 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
NinjaTeam Chat for Telegram
Affected
up to 1.1
What to do
Affects up to 1.1. Update NinjaTeam Chat for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2025LA-Studio Element Kit for Elementor: Stored Cross-Site ScriptingCVE-2025-4943 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-lakit-element-link’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2025Minimal Share Buttons: Stored Cross-Site ScriptingCVE-2025-5259 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Minimal Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Minimal Share Buttons
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Minimal Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 29, 2025Bold Page Builder: Stored Cross-Site ScriptingCVE-2025-5286 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additional_settings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.3.6
What to do
Affects up to 5.3.6. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 29, 2025Map Block Leaflet: Stored Cross-Site ScriptingCVE-2025-5122 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Map Block Leaflet
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Map Block Leaflet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 29, 2025Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Stored Cross-Site ScriptingCVE-2025-4670 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edd_receipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Affected
up to 3.3.8.1
What to do
Affects up to 3.3.8.1. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 29, 2025Smash Balloon Social Photo Feed – Easy Social Feeds: Stored Cross-Site ScriptingCVE-2025-4583 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-plugin` attribute in all versions up to, and including, 6.9.0 (Free) and 6.8.0 (Pro) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smash Balloon Social Photo Feed – Easy Social Feeds
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update Smash Balloon Social Photo Feed – Easy Social Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 28, 2025WP Extended: Stored Cross-Site ScriptingCVE-2025-4963 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Extended
Affected
up to 3.0.15
What to do
Affects up to 3.0.15. Update WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 26, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized modification of dataCVE-2025-4683 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.17.5
What to do
Affects up to 4.17.5. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 26, 2025Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2025-4682 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML attributes in Slider and Post Carousel widgets in all versions up to, and including, 5.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 5.4.0
What to do
Affects up to 5.4.0. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 26, 2025Exclusive Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-4783 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of the Countdown Timer Widget in all versions up to, and including, 2.7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Exclusive Addons for Elementor
Affected
up to 2.7.9.1
What to do
Affects up to 2.7.9.1. Update Exclusive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 24, 2025eMagicOne Store Manager for WooCommerce: Arbitrary file uploadsCVE-2025-5058 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_image() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials.
Product
eMagicOne Store Manager for WooCommerce
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update eMagicOne Store Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 24, 2025eMagicOne Store Manager for WooCommerce: Arbitrary file deletionCVE-2025-4603 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials.
Product
eMagicOne Store Manager for WooCommerce
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update eMagicOne Store Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 24, 2025eMagicOne Store Manager for WooCommerce: Arbitrary File ReadsCVE-2025-4602 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the get_file() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials.
Product
eMagicOne Store Manager for WooCommerce
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update eMagicOne Store Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 24, 2025eMagicOne Store Manager for WooCommerce: Arbitrary file uploadsCVE-2025-4336 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_file() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials.
Product
eMagicOne Store Manager for WooCommerce
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update eMagicOne Store Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 23, 2025Smart Forms – when you need more than just a contact form: Stored Cross-Site ScriptingCVE-2025-5055 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Smart Forms – when you need more than just a contact form
Affected
up to 2.6.98
What to do
Affects up to 2.6.98. Update Smart Forms – when you need more than just a contact form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 23, 2025Page Builder: Pagelayer – Drag and Drop website builder: Stored Cross-Site ScriptingCVE-2024-13427 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 1.9.9 and completely fixed in version 2.0.1.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 2.0.0
Fixed in
1.9.9
What to do
Update Page Builder: Pagelayer – Drag and Drop website builder to 1.9.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2025StoreKeeper for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-47687 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.
Product
StoreKeeper for WooCommerce
Affected
up to 14.4.4
What to do
Affects up to 14.4.4. Update StoreKeeper for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Solid Mail – SMTP email and logging made by SolidWP: Stored Cross-Site ScriptingCVE-2025-1123 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Solid Mail – SMTP email and logging made by SolidWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email Name, Subject, and Body in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Solid Mail – SMTP email and logging made by SolidWP
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Solid Mail – SMTP email and logging made by SolidWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2025TablePress: DOM-Based Stored Cross-Site ScriptingCVE-2025-5096 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', 'data-s-title', and 'data-footer' data-attributes in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TablePress
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update TablePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record datatables.net github.com
May 23, 2025Tournamatch: Stored Cross-Site ScriptingCVE-2025-4594 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tournamatch
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update Tournamatch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2025Hot Random Image: Stored Cross-Site ScriptingCVE-2025-4405 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Hot Random Image
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Hot Random Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2025MapSVG: Stored Cross-Site ScriptingCVE-2024-9544 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 8.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
MapSVG
Affected
up to 8.6.4
What to do
Affects up to 8.6.4. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record simplepx.com wordfence.com
May 21, 2025Slim SEO – Fast & Automated WordPress SEO: Stored Cross-Site ScriptingCVE-2025-4611 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs shortcode in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slim SEO – Fast & Automated WordPress SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Slim SEO – Fast & Automated WordPress SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 21, 2025Animated Buttons: Stored Cross-Site ScriptingCVE-2025-4221 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Animated Buttons
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Animated Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025DPEPress: Stored Cross-Site ScriptingCVE-2025-4219 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DPEPress
Affected
up to 0.3
What to do
Affects up to 0.3. Update DPEPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025WP YouTube Video Optimizer: Stored Cross-Site ScriptingCVE-2025-4217 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP YouTube Video Optimizer
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP YouTube Video Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025Raisely Donation Form: Stored Cross-Site ScriptingCVE-2025-3781 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Raisely Donation Form
Affected
up to 1.1
What to do
Affects up to 1.1. Update Raisely Donation Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2025Network Posts Extended: Stored Cross-Site ScriptingCVE-2025-3750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Network Posts Extended
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update Network Posts Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 20, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in varioCVE-2024-5878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2025Super Store Finder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39445 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.2.
Product
Super Store Finder
Affected
up to 7.2
What to do
Affects up to 7.2. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic: Stored Cross-Site ScriptingCVE-2025-2892 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
Affected
up to 4.8.1.1
What to do
Affects up to 4.8.1.1. Update All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 18, 2025Bold Page Builder: Stored Cross-Site ScriptingCVE-2025-3715 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2025WP Booking Calendar: Stored Cross-Site ScriptingCVE-2025-4669 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Booking Calendar
Affected
up to 10.11.1
What to do
Affects up to 10.11.1. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2025Jupiter X Core: Stored Cross-Site ScriptingCVE-2025-3888 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the included SVG file.
Product
Jupiter X Core
Affected
up to 4.8.12
What to do
Affects up to 4.8.12. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2025WP-Members Membership: Stored Cross-Site ScriptingCVE-2025-4610 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_user_memberships shortcode in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Members Membership
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2025Posts per Cat [Unmaintained: Stored Cross-Site ScriptingCVE-2025-4169 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Posts per Cat [Unmaintained
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Posts per Cat [Unmaintained to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 15, 2025In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of thCVE-2024-7761 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
Product
process of testing the Simple Job Board
Fixed in
2.12.2
What to do
Update process of testing the Simple Job Board to 2.12.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025JSP Store Locator: Does not have CSRF checks in some placesCVE-2024-12301 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
Product
JSP Store Locator
Affected
up to 1.0
What to do
Affects up to 1.0. Update JSP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025JSP Store Locator: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11267 · WordPress plugins & themes · reported by WPScanHigh 8.8
The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing user with Contributor to perform SQL injection attacks.
Product
JSP Store Locator
Affected
up to 1.0
What to do
Affects up to 1.0. Update JSP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Weluka Lite: Stored Cross-Site ScriptingCVE-2025-4591 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Weluka Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Weluka Lite
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Weluka Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 15, 2025Bon Toolkit: Stored Cross-Site ScriptingCVE-2025-4589 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bon Toolkit
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Bon Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 15, 2025EG-Series: Stored Cross-Site ScriptingCVE-2025-4126 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode_title function. This makes it possible for authenticated attackers - with contributor-level access and above, on sites with the Classic Editor plugin activated - to inject arbitrary JavaScript code in the titletag attribute that will execute whenever a user access an injected page.
Product
EG-Series
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update EG-Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.