Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

514 results · page 5 of 11

Apr 15, 2025Barcode Generator for WooCommerce: Missing AuthorizationCVE-2025-32929 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Barcode Generator for WooCommerce: from n/a through <= 2.0.4.
Product
Barcode Generator for WooCommerce
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Barcode Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Advance WP Query Search Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26743 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Advance WP Query Search Filter advance-wp-query-search-filter allows Reflected XSS.This issue affects Advance WP Query Search Filter: from n/a through <= 1.0.10.
Product
Advance WP Query Search Filter
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Advanced All in One Admin Search by WP Spotlight: Cross-Site Request Forgery (CSRF)CVE-2025-32261 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kuppuraj Advanced All in One Admin Search by WP Spotlight wp-spotlight-search allows Cross Site Request Forgery.This issue affects Advanced All in One Admin Search by WP Spotlight: from n/a through <= 1.1.1.
Product
Advanced All in One Admin Search by WP Spotlight
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Advanced All in One Admin Search by WP Spotlight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Search, Filters & Merchandising for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32181 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fast Simon Search, Filters & Merchandising for WooCommerce instantsearch-for-woocommerce allows Stored XSS.This issue affects Search, Filters & Merchandising for WooCommerce: from n/a through <= 3.0.58.
Product
Search, Filters & Merchandising for WooCommerce
Affected
up to 3.0.58
What to do
Affects up to 3.0.58. Update Search, Filters & Merchandising for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025VK Filter Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32175 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Filter Search vk-filter-search allows Stored XSS.This issue affects VK Filter Search: from n/a through <= 2.20.2.
Product
VK Filter Search
Affected
up to 2.20.2
What to do
Affects up to 2.20.2. Update VK Filter Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025Search engine keywords highlighter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31442 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e1tekoap42 Search engine keywords highlighter keywords-highlight-tool allows Reflected XSS.This issue affects Search engine keywords highlighter: from n/a through <= 0.1.3.
Product
Search engine keywords highlighter
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Search engine keywords highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 2, 2025Advanced Search by My Solr Server: Cross-Site Request ForgeryCVE-2025-3099 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced Search by My Solr Server plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the 'MySolrServerSettings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Advanced Search by My Solr Server
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Advanced Search by My Solr Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2025AI Search Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vimal Kava AI Search Bar open-ai-search-bar allows Stored XSS.This issue affects AI Search Bar: from n/a through <= 2.1.
Product
AI Search Bar
Affected
up to 2.1
What to do
Affects up to 2.1. Update AI Search Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Barcode Generator for WooCommerce: Missing AuthorizationCVE-2025-31879 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Barcode Generator for WooCommerce: from n/a through <= 2.0.4.
Product
Barcode Generator for WooCommerce
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Barcode Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Advanced Post Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VarDump s.r.l. Advanced Post Search advanced-post-search allows Reflected XSS.This issue affects Advanced Post Search: from n/a through <= 1.1.0.
Product
Advanced Post Search
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Advanced Post Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31043 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.7.
Product
JetSearch
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025WP Ultimate Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31452 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mindshare Labs, Inc. WP Ultimate Search wp-ultimate-search allows Stored XSS.This issue affects WP Ultimate Search: from n/a through <= 2.0.3.
Product
WP Ultimate Search
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update WP Ultimate Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WP Fast Total Search: Missing AuthorizationCVE-2025-30894 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.79.262.
Product
WP Fast Total Search
Affected
up to 1.79.262
What to do
Affects up to 1.79.262. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025SearchIQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ searchiq allows Stored XSS.This issue affects SearchIQ: from n/a through <= 4.7.
Product
SearchIQ
Affected
up to 4.7
What to do
Affects up to 4.7. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Fiverr.com Official Search Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28885 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fiverraffiliates Fiverr.com Official Search Box fiverr-official-search-box allows Stored XSS.This issue affects Fiverr.com Official Search Box: from n/a through <= 1.0.8.
Product
Fiverr.com Official Search Box
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Fiverr.com Official Search Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2025Advanced Woo Search: Stored Cross-Site ScriptingCVE-2025-2302 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aws_search_terms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Woo Search
Affected
up to 3.28
What to do
Affects up to 3.28. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025WordPress WP-Advanced-Search: Does not sanitise and escape some of its settingsCVE-2024-10554 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WordPress WP-Advanced-Search
Fixed in
3.3.9.3
What to do
Update WordPress WP-Advanced-Search to 3.3.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Mar 14, 2025Search & Filter Pro: Unauthorized access of dataCVE-2025-1528 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function in all versions up to, and including, 2.5.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the values of arbitrary post meta.
Product
Search & Filter Pro
Affected
up to 2.5.19
What to do
Affects up to 2.5.19. Update Search & Filter Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record searchandfilter.com wordfence.com
Mar 11, 2025Lava Ajax Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28937 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored XSS.This issue affects Lava Ajax Search: from n/a through <= 1.1.9.
Product
Lava Ajax Search
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Lava Ajax Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2025SearchIQ – The Search Solution: Stored Cross-Site ScriptingCVE-2024-13350 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SearchIQ – The Search Solution
Affected
up to 4.7
What to do
Affects up to 4.7. Update SearchIQ – The Search Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 3, 2025Interactive Page Hierarchy: Missing AuthorizationCVE-2025-23615 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in gtekelis Interactive Page Hierarchy interactive-page-hierarchy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Interactive Page Hierarchy: from n/a through <= 1.0.1.
Product
Interactive Page Hierarchy
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Interactive Page Hierarchy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Curated Search: Cross-Site Request Forgery (CSRF)CVE-2025-23502 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ned Curated Search curated-search allows Stored XSS.This issue affects Curated Search: from n/a through <= 1.2.
Product
Curated Search
Affected
up to 1.2
What to do
Affects up to 1.2. Update Curated Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Search with Typesense: Path Traversal: '.../...//'CVE-2025-26876 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Path Traversal: '.../...//' vulnerability in CodeManas Search with Typesense search-with-typesense allows Path Traversal.This issue affects Search with Typesense: from n/a through <= 2.0.8.
Product
Search with Typesense
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Search with Typesense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Local Search SEO Contact Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27351 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpertBusinessSearch Local Search SEO Contact Page local-search-seo-contact-page allows Stored XSS.This issue affects Local Search SEO Contact Page: from n/a through <= 4.0.1.
Product
Local Search SEO Contact Page
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Local Search SEO Contact Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Bravo Search & Replace: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-27297 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in guelben Bravo Search & Replace bravo-search-and-replace allows Blind SQL Injection.This issue affects Bravo Search & Replace: from n/a through <= 1.0.
Product
Bravo Search & Replace
Affected
up to 1.0
What to do
Affects up to 1.0. Update Bravo Search & Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Archive Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27280 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alobaidi Archive Page archive-page allows DOM-Based XSS.This issue affects Archive Page: from n/a through <= 1.0.2.
Product
Archive Page
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Archive Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 21, 2025The Custom Post Type Date Archives: Arbitrary shortcode executionCVE-2025-1510 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Custom Post Type Date Archives
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update The Custom Post Type Date Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 21, 2025Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-13585 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ajax Search Lite
Fixed in
4.12.5
What to do
Update Ajax Search Lite to 4.12.5 or newer.
Full record and what to do →NVD record wpscan.com
Feb 14, 2025HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce: Stored Cross-Site ScriptingCVE-2024-13735 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping of a campaign name. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce
Affected
up to 2.11.2
What to do
Affects up to 2.11.2. Update HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.hurrytimer.com plugins.trac.wordpress.org
Feb 12, 2025NGG Smart Image Search: Stored Cross-Site ScriptingCVE-2024-13658 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
NGG Smart Image Search
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2025FlexIDX Home Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25082 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allows Stored XSS.This issue affects FlexIDX Home Search: from n/a through <= 2.1.2.
Product
FlexIDX Home Search
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update FlexIDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025Site Search 360: Stored Cross-Site ScriptingCVE-2024-11780 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Site Search 360 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ss360-resultblock' shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Site Search 360
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Site Search 360 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2025Barcode Generator for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2025-24597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Retrieve Embedded Sensitive Data.This issue affects Barcode Generator for WooCommerce: from n/a through <= 2.0.2.
Product
Barcode Generator for WooCommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Barcode Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025WP OpenSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23671 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sav WP OpenSearch wp-opensearch allows Stored XSS.This issue affects WP OpenSearch: from n/a through <= 1.0.
Product
WP OpenSearch
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP OpenSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025Fantastic ElasticSearch: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13221 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Fantastic ElasticSearch
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Fantastic ElasticSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 30, 2025Automatically Hierarchic Categories in Menu: Stored Cross-Site ScriptingCVE-2024-13466 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Automatically Hierarchic Categories in Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autocategorymenu' shortcode in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Automatically Hierarchic Categories in Menu
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2025Print Barcode Labels for your WooCommerce products/orders: Missing AuthorizationCVE-2025-24603 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through <= 3.4.10.
Product
Print Barcode Labels for your WooCommerce products/orders
Affected
up to 3.4.10
What to do
Affects up to 3.4.10. Update Print Barcode Labels for your WooCommerce products/orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025WP Fast Total Search: Cross-Site Request Forgery (CSRF)CVE-2025-24572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.
Product
WP Fast Total Search
Affected
up to 1.78.258
What to do
Affects up to 1.78.258. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025WP Fast Total Search: Missing AuthorizationCVE-2025-24571 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.
Product
WP Fast Total Search
Affected
up to 1.78.258
What to do
Affects up to 1.78.258. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WordPress File Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23867 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markcoker WordPress File Search wpfilesearch allows Reflected XSS.This issue affects WordPress File Search: from n/a through <= 1.2.
Product
WordPress File Search
Affected
up to 1.2
What to do
Affects up to 1.2. Update WordPress File Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025CtyGrid Hyp3rL0cal Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinlane CtyGrid Hyp3rL0cal Search hyp3rl0cal-city-search allows Reflected XSS.This issue affects CtyGrid Hyp3rL0cal Search: from n/a through <= 0.1.1.1.
Product
CtyGrid Hyp3rL0cal Search
Affected
up to 0.1.1.1
What to do
Affects up to 0.1.1.1. Update CtyGrid Hyp3rL0cal Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WooCommerce Order Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23495 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chetan Khandla WooCommerce Order Search woocommerce-order-searching allows Reflected XSS.This issue affects WooCommerce Order Search: from n/a through <= 1.1.0.
Product
WooCommerce Order Search
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WooCommerce Order Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Barcode Scanner with Inventory & Order Manager: Unrestricted Upload of File with Dangerous TypeCVE-2025-22723 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Upload a Web Shell to a Web Server.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.7.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Ajax WP Query Search Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23926 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Ajax WP Query Search Filter ajax-wp-query-search-filter allows Stored XSS.This issue affects Ajax WP Query Search Filter: from n/a through <= 1.0.7.
Product
Ajax WP Query Search Filter
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Ajax WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025WP Custom Google Search: Cross-Site Request Forgery (CSRF)CVE-2025-23698 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ivanra10 WP Custom Google Search wp-custom-google-search allows Stored XSS.This issue affects WP Custom Google Search: from n/a through <= 1.0.
Product
WP Custom Google Search
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Custom Google Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Lijit Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22778 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in damniel Lijit Search wp-lijit-wijit allows Reflected XSS.This issue affects Lijit Search: from n/a through <= 1.1.
Product
Lijit Search
Affected
up to 1.1
What to do
Affects up to 1.1. Update Lijit Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025Qr Code and Barcode Scanner Reader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22819 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roberto Bottalico Qr Code and Barcode Scanner Reader qr-code-and-barcode-scanner-reader allows Stored XSS.This issue affects Qr Code and Barcode Scanner Reader: from n/a through <= 1.0.0.
Product
Qr Code and Barcode Scanner Reader
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Qr Code and Barcode Scanner Reader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025Searchie: Stored Cross-Site ScriptingCVE-2024-12819 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Searchie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sio_embed_media' shortcode in all versions up to, and including, 1.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Searchie
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update Searchie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 7, 2025Arcade Ready: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22581 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bytephp Arcade Ready arcadeready allows Stored XSS.This issue affects Arcade Ready: from n/a through <= 1.1.
Product
Arcade Ready
Affected
up to 1.1
What to do
Affects up to 1.1. Update Arcade Ready to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WP Fast Total Search: Cross-Site Request Forgery (CSRF)CVE-2024-38778 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.69.234.
Product
WP Fast Total Search
Affected
up to 1.69.234
What to do
Affects up to 1.69.234. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.