Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

1,222 results · page 5 of 25

Mar 25, 2026WZone: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-27039 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone woozone allows Blind SQL Injection.This issue affects WZone: from n/a through <= 14.0.31.
Product
WZone
Affected
up to 14.0.31
What to do
Affects up to 14.0.31. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Addon Jobsearch Chat: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25377 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows SQL Injection.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.
Product
Addon Jobsearch Chat
Affected
up to 3.0
What to do
Affects up to 3.0. Update Addon Jobsearch Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Lumise Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25371 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.
Product
Lumise Product Designer
What to do
Update Lumise Product Designer to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Jobmonster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25340 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4.
Product
Jobmonster
What to do
Update Jobmonster to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026ElementInvader Addons for Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25007 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Blind SQL Injection.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.2.
Product
ElementInvader Addons for Elementor
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Advanced WooCommerce Product Sales Reporting: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24993 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Blind SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.3.
Product
Advanced WooCommerce Product Sales Reporting
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update Advanced WooCommerce Product Sales Reporting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Organici Library: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24977 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Organici Library noo-organici-library allows Blind SQL Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
Product
Organici Library
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Organici Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Gyan Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-23979 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softwebmedia Gyan Elements gyan-elements allows Reflected XSS.This issue affects Gyan Elements: from n/a through <= 2.2.1.
Product
Gyan Elements
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Gyan Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Lisfinity Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-22484 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pebas Lisfinity Core lisfinity-core allows SQL Injection.This issue affects Lisfinity Core: from n/a through <= 1.5.0.
Product
Lisfinity Core
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Lisfinity Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2026Profile Builder Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-27413 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a before 3.14.0.
Product
Profile Builder Pro
Fixed in
3.14.0
What to do
Update Profile Builder Pro to 3.14.0 or newer.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026UpsellWP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32459 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.
Product
UpsellWP
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update UpsellWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WOLF: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32458 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through <= 1.0.8.7.
Product
WOLF
Affected
up to 1.0.8.7
What to do
Affects up to 1.0.8.7. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026CP Contact Form with Paypal: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32433 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: from n/a through <= 1.3.61.
Product
CP Contact Form with Paypal
Affected
up to 1.3.61
What to do
Affects up to 1.3.61. Update CP Contact Form with Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WP EasyCart: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32422 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through <= 5.8.13.
Product
WP EasyCart
Affected
up to 5.8.13
What to do
Affects up to 5.8.13. Update WP EasyCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Meow Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32418 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Blind SQL Injection.This issue affects Meow Gallery: from n/a through <= 5.4.4.
Product
Meow Gallery
Affected
up to 5.4.4
What to do
Affects up to 5.4.4. Update Meow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Media LIbrary Assistant: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32399 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.32.
Product
Media LIbrary Assistant
Affected
up to 3.32
What to do
Affects up to 3.32. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Geo to Lat: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32368 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injection.This issue affects Geo to Lat: from n/a through <= 1.0.19.
Product
Geo to Lat
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Geo to Lat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Collapsing Categories: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32366 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allows Blind SQL Injection.This issue affects Collapsing Categories: from n/a through <= 3.0.9.
Product
Collapsing Categories
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update Collapsing Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Collapsing Archives: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32365 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Archives collapsing-archives allows Blind SQL Injection.This issue affects Collapsing Archives: from n/a through <= 3.0.7.
Product
Collapsing Archives
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Collapsing Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32358 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection.This issue affects Booking Calendar: from n/a through <= 10.14.15.
Product
Booking Calendar
Affected
up to 10.14.15
What to do
Affects up to 10.14.15. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Fox LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-31922 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Fox LMS fox-lms allows Blind SQL Injection.This issue affects Fox LMS: from n/a through <= 1.0.6.3.
Product
Fox LMS
Affected
up to 1.0.6.3
What to do
Affects up to 1.0.6.3. Update Fox LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WP ERP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-31917 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a through <= 1.16.10.
Product
WP ERP
Affected
up to 1.16.10
What to do
Affects up to 1.16.10. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 10, 2026Unlimited Elements for Elementor: Stored Cross-Site ScriptingCVE-2026-2724 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and including, 2.0.5. This is due to insufficient input sanitization and output escaping on form submission data displayed in the admin Form Entries Trash view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the trashed form entries.
Product
Unlimited Elements for Elementor
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Unlimited Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026WP Attractive Donations System - Easy Stripe & Paypal donations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-28115 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.
Product
WP Attractive Donations System - Easy Stripe & Paypal donations
Affected
up to 1.25
What to do
Affects up to 1.25. Update WP Attractive Donations System - Easy Stripe & Paypal donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Eagle Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-27428 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eagle-Themes Eagle Booking eagle-booking allows SQL Injection.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.
Product
Eagle Booking
Affected
up to 1.3.4.3
What to do
Affects up to 1.3.4.3. Update Eagle Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Tablesome: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-27373 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome tablesome allows Blind SQL Injection.This issue affects Tablesome: from n/a through <= 1.2.3.
Product
Tablesome
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Riode Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69338 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injection.This issue affects Riode Core: from n/a through <= 1.6.26.
Product
Riode Core
Affected
up to 1.6.26
What to do
Affects up to 1.6.26. Update Riode Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2026WP SMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-28136 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs WP SMS wp-sms allows SQL Injection.This issue affects WP SMS: from n/a through <= 6.9.12.
Product
WP SMS
Affected
up to 6.9.12
What to do
Affects up to 6.9.12. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2026Elementor Addon Elements: Insertion of Sensitive Information Into Sent DataCVE-2026-28131 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through <= 1.14.4.
Product
Elementor Addon Elements
Affected
up to 1.14.4
What to do
Affects up to 1.14.4. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 23, 2026ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endCVE-2026-23693 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wpmet.com
Feb 20, 2026JS Help Desk: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24959 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.
Product
JS Help Desk
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Download Manager Addons for Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24956 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-elementor allows Blind SQL Injection.This issue affects Download Manager Addons for Elementor: from n/a through <= 1.3.0.
Product
Download Manager Addons for Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Download Manager Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Emerce Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69366 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Injection.This issue affects Emerce Core: from n/a through <= 1.8.
Product
Emerce Core
Affected
up to 1.8
What to do
Affects up to 1.8. Update Emerce Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Uroan Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69365 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Uroan Core uroan-core allows Blind SQL Injection.This issue affects Uroan Core: from n/a through <= 1.4.4.
Product
Uroan Core
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Uroan Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Wolmart Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69337 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Wolmart Core wolmart-core allows Blind SQL Injection.This issue affects Wolmart Core: from n/a through <= 1.9.6.
Product
Wolmart Core
Affected
up to 1.9.6
What to do
Affects up to 1.9.6. Update Wolmart Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Woodly Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69310 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Woodly Core woodly-core allows Blind SQL Injection.This issue affects Woodly Core: from n/a through <= 1.4.
Product
Woodly Core
Affected
up to 1.4
What to do
Affects up to 1.4. Update Woodly Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Saasplate Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69309 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind SQL Injection.This issue affects Saasplate Core: from n/a through <= 1.2.8.
Product
Saasplate Core
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Saasplate Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Nestbyte Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69308 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Nestbyte Core nestbyte-core allows Blind SQL Injection.This issue affects Nestbyte Core: from n/a through <= 1.2.
Product
Nestbyte Core
Affected
up to 1.2
What to do
Affects up to 1.2. Update Nestbyte Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Medinik Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69307 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Medinik Core medinik-core allows Blind SQL Injection.This issue affects Medinik Core: from n/a through <= 1.3.6.
Product
Medinik Core
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Medinik Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Electio Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69306 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Electio Core electio-core allows Blind SQL Injection.This issue affects Electio Core: from n/a through <= 1.4.
Product
Electio Core
Affected
up to 1.4
What to do
Affects up to 1.4. Update Electio Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Crete Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69305 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injection.This issue affects Crete Core: from n/a through <= 1.4.3.
Product
Crete Core
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Crete Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Allmart: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69304 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Allmart allmart-core allows Blind SQL Injection.This issue affects Allmart: from n/a through <= 1.1.
Product
Allmart
Affected
up to 1.1
What to do
Affects up to 1.1. Update Allmart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Coven Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69295 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Coven Core coven-core allows Blind SQL Injection.This issue affects Coven Core: from n/a through <= 1.3.
Product
Coven Core
Affected
up to 1.3
What to do
Affects up to 1.3. Update Coven Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67987 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1.
Product
Quiz And Survey Master
Affected
up to 10.3.1
What to do
Affects up to 10.3.1. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Bit Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25418 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.21.10.
Product
Bit Form
Affected
up to 2.21.10
What to do
Affects up to 2.21.10. Update Bit Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Nelio AB Testing: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25378 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.4.
Product
Nelio AB Testing
Affected
up to 8.2.4
What to do
Affects up to 8.2.4. Update Nelio AB Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Media Search Enhanced: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-23805 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yoren Chang Media Search Enhanced media-search-enhanced allows SQL Injection.This issue affects Media Search Enhanced: from n/a through <= 0.9.1.
Product
Media Search Enhanced
Affected
up to 0.9.1
What to do
Affects up to 0.9.1. Update Media Search Enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026KiviCare: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25022 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.
Product
KiviCare
Affected
up to 3.6.16
What to do
Affects up to 3.6.16. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.12.2.
Product
JetElements For Elementor
Affected
up to 2.7.12.2
What to do
Affects up to 2.7.12.2. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Unlimited Elements for Elementor: Stored Cross-Site ScriptingCVE-2025-14274 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versions up to 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Unlimited Elements for Elementor
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Unlimited Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.