Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

439new WordPress flaws this week

394,398entries in the database

407 results · page 5 of 9

Mar 15, 2025School Management System – WPSchoolPress: SQL InjectionCVE-2025-1670 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.16
What to do
Affects up to 2.2.16. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025School Management System – WPSchoolPress: SQL InjectionCVE-2025-1669 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with teacher-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.17
What to do
Affects up to 2.2.17. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025School Management System – WPSchoolPress: Arbitrary user deletionCVE-2025-1668 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_DeleteUser() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to delete arbitrary user accounts.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.16
What to do
Affects up to 2.2.16. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025School Management System – WPSchoolPress: Privilege EscalationCVE-2025-1667 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTeacher() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to update arbitrary user details including email which makes it possible to request a password reset and access arbitrary user accounts, including administrators.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.16
What to do
Affects up to 2.2.16. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025CM FAQ – Simplify support with an intuitive FAQ management tool: Reflected Cross-Site ScriptingCVE-2025-2166 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CM FAQ – Simplify support with an intuitive FAQ management tool
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update CM FAQ – Simplify support with an intuitive FAQ management tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 12, 2025CRM and Lead Management by vcita: Unauthorized modification of dataCVE-2024-13703 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae() function in all versions up to, and including, 2.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable and disable plugin widgets.
Product
CRM and Lead Management by vcita
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025VikRentCar Car Rental Management System: Cross-Site Request ForgeryCVE-2024-11640 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2025School Management System for: Privilege escalationCVE-2024-9658 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 93.0.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email and password through the mj_smgt_update_user() and mj_smgt_add_admission() functions, along with a local file inclusion vulnerability. This makes it possible for authenticated attackers, with student-level access and above, to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account. This was escalated four months ago after no response to our initial outreach, yet it still vulnerable.
Product
School Management System for
Affected
up to 93.0.0
What to do
Affects up to 93.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 7, 2025School Management System for: Reflected Cross-Site ScriptingCVE-2024-12611 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 93.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
School Management System for
Affected
up to 93.0.0
What to do
Affects up to 93.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 7, 2025School Management System for: Unauthorized loss of dataCVE-2024-12610 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mj_smgt_remove_feetype' and 'mj_smgt_remove_category_new' AJAX actions in all versions up to, and including, 93.0.0. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
School Management System for
Affected
up to 93.0.0
What to do
Affects up to 93.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 7, 2025School Management System for: SQL InjectionCVE-2024-12609 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'view-attendance' page in all versions up to, and including, 92.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the mj_smgt_view_student_attendance() function. This makes it possible for authenticated attackers, with Student-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
School Management System for
Affected
up to 92.0.0
What to do
Affects up to 92.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 7, 2025School Management System for: SQL InjectionCVE-2024-12607 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'mj_smgt_show_event_task' AJAX action in all versions up to, and including, 92.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
School Management System for
Affected
up to 92.0.0
What to do
Affects up to 92.0.0. Update School Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 3, 2025Heartland Management Terminal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecureSubmit Heartland Management Terminal allows Reflected XSS. This issue affects Heartland Management Terminal: from n/a through 1.3.0.
Product
Heartland Management Terminal
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Heartland Management Terminal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 28, 2025KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2025-1572 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and including, 3.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
KiviCare – Clinic & Patient Management System (EHR)
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025School Management System – SakolaWP: Cross-Site Request ForgeryCVE-2024-13647 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The School Management System – SakolaWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the 'save_exam_setting' and 'delete_exam_setting' actions. This makes it possible for unauthenticated attackers to update exam settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
School Management System – SakolaWP
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update School Management System – SakolaWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 25, 2025Wired Impact Volunteer Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26980 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Stored XSS.This issue affects Wired Impact Volunteer Management: from n/a through <= 2.5.
Product
Wired Impact Volunteer Management
Affected
up to 2.5
What to do
Affects up to 2.5. Update Wired Impact Volunteer Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2025WP Media Category Management: Cross-Site Request ForgeryCVE-2025-0865 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wp_mcm_handle_action_settings() function. This makes it possible for unauthenticated attackers to alter plugin settings, such as the taxonomy used for media, the base slug for media categories, and the default media category via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Media Category Management
Affected
2.0 to 2.3.3
What to do
Affects 2.0 to 2.3.3. Update WP Media Category Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2025Affiliate Links: WordPress Plugin for Link Cloaking and Link Management: PHP Object InjectionCVE-2024-13556 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.1 via deserialization of untrusted input from an file export. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Affiliate Links: WordPress Plugin for Link Cloaking and Link Management
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Affiliate Links: WordPress Plugin for Link Cloaking and Link Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 17, 2025ImageMeta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23845 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta imagemeta allows Reflected XSS.This issue affects ImageMeta: from n/a through <= 1.1.2.
Product
ImageMeta
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update ImageMeta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 15, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Time-based SQL InjectionCVE-2024-13500 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Affected
up to 2.6.17
What to do
Affects up to 2.6.17. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 15, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Unauthorized loss of dataCVE-2024-13752 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cause a persistent denial of service condition.
Product
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Affected
up to 2.6.17
What to do
Affects up to 2.6.17. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2025Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features: Insecure Direct Object ReferenceCVE-2024-13692 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 via several functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite linked refund image attachments, overwrite refund request message, overwrite order messages, and read order messages of other users.
Product
Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features
Affected
up to 4.4.5
What to do
Affects up to 4.4.5. Update Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2025Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features: Sensitive Information ExposureCVE-2024-13641 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
Product
Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features
Affected
up to 4.4.5
What to do
Affects up to 4.4.5. Update Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 13, 2025Simple Video Management System: Does not sanitise and escape some of its settingsCVE-2025-0692 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple Video Management System
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Simple Video Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 1, 2025MultiLoca - WooCommerce Multi Locations Inventory Management: SQL InjectionCVE-2024-13341 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via the 'data-id' parameter in all versions up to, and including, 4.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MultiLoca - WooCommerce Multi Locations Inventory Management
Affected
up to 4.1.11
What to do
Affects up to 4.1.11. Update MultiLoca - WooCommerce Multi Locations Inventory Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jan 28, 2025Philantro – Donations and Donor Management: Stored Cross-Site ScriptingCVE-2024-13527 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Philantro – Donations and Donor Management
Affected
up to 5.3
What to do
Affects up to 5.3. Update Philantro – Donations and Donor Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 27, 2025LawPress – Law Firm Website Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23756 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanchernyakov LawPress – Law Firm Website Management lawpress allows Reflected XSS.This issue affects LawPress – Law Firm Website Management: from n/a through <= 1.4.5.
Product
LawPress – Law Firm Website Management
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update LawPress – Law Firm Website Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025RSVP and Event Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24683 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill RSVP and Event Management rsvp allows SQL Injection.This issue affects RSVP and Event Management: from n/a through <= 2.7.14.
Product
RSVP and Event Management
Affected
up to 2.7.14
What to do
Affects up to 2.7.14. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Visual Website Collaboration, Feedback & Project Management – Atarim: Unauthorized loss of dataCVE-2024-12104 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpf_delete_file and wpf_delete_file functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attackers to delete project pages and files. CVE-2025-22657 may be a duplicate of this issue.
Product
Visual Website Collaboration, Feedback & Project Management – Atarim
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2025Real Seguro Viagem: Cross-Site Request Forgery (CSRF)CVE-2025-23664 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Real Seguro Viagem Real Seguro Viagem seguro-viagem allows Stored XSS.This issue affects Real Seguro Viagem: from n/a through <= 2.0.5.
Product
Real Seguro Viagem
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Real Seguro Viagem to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025User Management: Incorrect Privilege AssignmentCVE-2025-22736 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from n/a through <= 1.2.
Product
User Management
Affected
up to 1.2
What to do
Affects up to 1.2. Update User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 13, 2025Event Monster – Event Management, Tickets Booking, Upcoming Event: Information ExposureCVE-2024-11396 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.
Product
Event Monster – Event Management, Tickets Booking, Upcoming Event
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025WP Travel – Ultimate Travel Booking System, Tour Management Engine: SQL InjectionCVE-2024-12067 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'booking_itinerary' parameter of the 'wptravel_get_booking_data' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Travel – Ultimate Travel Booking System, Tour Management Engine
Affected
up to 10.0.0
What to do
Affects up to 10.0.0. Update WP Travel – Ultimate Travel Booking System, Tour Management Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025MindValley Super PageMash: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22502 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mindvalley MindValley Super PageMash mindvalley-pagemash allows SQL Injection.This issue affects MindValley Super PageMash: from n/a through <= 1.1.
Product
MindValley Super PageMash
Affected
up to 1.1
What to do
Affects up to 1.1. Update MindValley Super PageMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025RSVP and Event Management: Unauthorized accessCVE-2024-12711 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_delete_attendees() and bulk_delete_questions() in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers to delete questions and attendees and for authenticated users to update question menu orders.
Product
RSVP and Event Management
Affected
up to 2.7.13
What to do
Affects up to 2.7.13. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Wp advertising management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simone Marcon Wp advertising management advertising-management allows Reflected XSS.This issue affects Wp advertising management: from n/a through <= 1.0.3.
Product
Wp advertising management
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Wp advertising management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025School Management System – SakolaWP: Privilege escalationCVE-2024-12470 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to the registration function not properly limiting what roles a user can register as. This makes it possible for unauthenticated attackers to register as an administrative user.
Product
School Management System – SakolaWP
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update School Management System – SakolaWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 7, 2025School Management System – WPSchoolPress: SQL InjectionCVE-2024-12332 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Student/Parent-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.14
What to do
Affects up to 2.2.14. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Simple Video Management System: Reflected Cross-Site ScriptingCVE-2024-12256 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Video Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'analytics_video' parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Simple Video Management System
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Simple Video Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 4, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: SQL InjectionCVE-2024-12195 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, who have been granted access to a project, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Affected
up to 2.6.16
What to do
Affects up to 2.6.16. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025Taskbuilder – WordPress Project & Task Management: Stored Cross-Site ScriptingCVE-2024-11930 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shortcode in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Taskbuilder – WordPress Project & Task Management
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update Taskbuilder – WordPress Project & Task Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024Philantro – Donations and Donor Management: Stored Cross-Site ScriptingCVE-2024-12500 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Philantro – Donations and Donor Management
Affected
up to 5.2
What to do
Affects up to 5.2. Update Philantro – Donations and Donor Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS: Reflected Cross-Site ScriptingCVE-2024-12127 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 0.0.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS
Affected
up to 0.0.21
What to do
Affects up to 0.0.21. Update Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 13, 2024AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot: Cross-Site Request Forgery (CSRF)CVE-2024-54306 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in aitool AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot ai-seo-translator allows Cross Site Request Forgery.This issue affects AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot: from n/a through <= 1.6.2.
Product
AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024Library Management System – Manage e-Digital Books Library: SQL InjectionCVE-2024-12406 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the 'owt7_borrow_books_id' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Library Management System – Manage e-Digital Books Library
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Library Management System – Manage e-Digital Books Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024Library Management System – Manage e-Digital Books Library: SQL InjectionCVE-2024-8679 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘value' parameter of the owt_lib_handler AJAX action in all versions up to, and including, 3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Library Management System – Manage e-Digital Books Library
Affected
up to 3.1
What to do
Affects up to 3.1. Update Library Management System – Manage e-Digital Books Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11730 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor/receptionist-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
KiviCare – Clinic & Patient Management System (EHR)
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11729 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of the get_widget_payment_options AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
KiviCare – Clinic & Patient Management System (EHR)
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024KiviCare – Clinic & Patient Management System (EHR): SQL InjectionCVE-2024-11728 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
KiviCare – Clinic & Patient Management System (EHR)
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 26, 2024Sugar Calendar – Simple Event Management: Reflected Cross-Site ScriptingCVE-2024-10878 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Sugar Calendar – Simple Event Management
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Sugar Calendar – Simple Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.