Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

9,082 results · page 56 of 182

Jan 22, 2026bidorbuy Store Integrator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68883 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Reflected XSS.This issue affects bidorbuy Store Integrator: from n/a through <= 2.12.0.
Product
bidorbuy Store Integrator
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update bidorbuy Store Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Institutions Directory: Missing AuthorizationCVE-2025-68058 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3..4.
Product
Institutions Directory
Affected
up to 1.3..4
What to do
Affects up to 1.3..4. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Hospital Doctor Directory: Missing AuthorizationCVE-2025-68057 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
Product
Hospital Doctor Directory
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Contact Form & Lead Form Elementor Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.
Product
Contact Form & Lead Form Elementor Builder
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Contact Form & Lead Form Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Antideo Email Validator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68017 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator allows Blind SQL Injection.This issue affects Antideo Email Validator: from n/a through <= 1.0.10.
Product
Antideo Email Validator
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Antideo Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Shown Connector: Missing AuthorizationCVE-2025-68003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.
Product
Shown Connector
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Shown Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Lawyer Directory: Missing AuthorizationCVE-2025-67967 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3.
Product
Lawyer Directory
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Lawyer Directory: Incorrect Privilege AssignmentCVE-2025-67966 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3.3.
Product
Lawyer Directory
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Movie Booking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-67963 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through <= 1.1.5.
Product
Movie Booking
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Movie Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026AdForest Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle AdForest Elementor adforest-elementor allows Reflected XSS.This issue affects AdForest Elementor: from n/a through <= 3.0.11.
Product
AdForest Elementor
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update AdForest Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Comparimager for Elementor: Missing AuthorizationCVE-2025-66142 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Comparimager for Elementor comparimager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comparimager for Elementor: from n/a through <= 1.0.1.
Product
Comparimager for Elementor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Comparimager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Uper for Elementor: Missing AuthorizationCVE-2025-66140 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.
Product
Uper for Elementor
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Uper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Audier For Elementor: Missing AuthorizationCVE-2025-66139 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9.
Product
Audier For Elementor
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Audier For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Motionger for Elementor: Missing AuthorizationCVE-2025-66138 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motionger for Elementor: from n/a through <= 2.0.4.
Product
Motionger for Elementor
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Motionger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Searcher for Elementor: Missing AuthorizationCVE-2025-66137 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3.
Product
Searcher for Elementor
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Searcher for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Carter for Elementor: Missing AuthorizationCVE-2025-66136 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carter for Elementor: from n/a through <= 1.0.2.
Product
Carter for Elementor
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Carter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Imager for Elementor: Missing AuthorizationCVE-2025-66135 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imager for Elementor: from n/a through <= 2.0.4.
Product
Imager for Elementor
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Imager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Grand Restaurant Theme Elements for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63026 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-elementor allows Stored XSS.This issue affects Grand Restaurant Theme Elements for Elementor: from n/a through <= 2.1.1.
Product
Grand Restaurant Theme Elements for Elementor
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Grand Restaurant Theme Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-47555 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
Product
Tutor LMS
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Element Pack Elementor Addons: Cross-Site Request Forgery (CSRF)CVE-2025-31413 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Cross Site Request Forgery.This issue affects Element Pack Elementor Addons: from n/a through <= 8.3.13.
Product
Element Pack Elementor Addons
Affected
up to 8.3.13
What to do
Affects up to 8.3.13. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026LA-Studio Element Kit for Elementor: Administrative User CreationCVE-2026-0920 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.5.6.3
What to do
Affects up to 1.5.6.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 20, 2026FlatPM – Ad Manager, AdSense and Custom Code: Stored Cross-Site ScriptingCVE-2026-0690 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rank_math_description' custom field in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FlatPM – Ad Manager, AdSense and Custom Code
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update FlatPM – Ad Manager, AdSense and Custom Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 20, 2026Head Meta Data: Stored Cross-Site ScriptingCVE-2026-0608 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all versions up to, and including, 20251118 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Head Meta Data
Affected
up to 20251118
What to do
Affects up to 20251118. Update Head Meta Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 20, 2026Tutor LMS – eLearning and online course solution: Unauthorized attachment deletionCVE-2026-0548 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 20, 2026Creator LMS – The LMS for Creators, Coaches, and Trainers: Unauthorized modification of data that can lead to privilege escalationCVE-2025-15347 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in the get_items_permissions_check function in all versions up to, and including, 1.1.12. This makes it possible for authenticated attackers, with contributor level access and above, to update arbitrary WordPress options.
Product
Creator LMS – The LMS for Creators, Coaches, and Trainers
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update Creator LMS – The LMS for Creators, Coaches, and Trainers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 20, 2026Viet contact: Stored Cross-Site ScriptingCVE-2026-1045 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Viet contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Viet contact
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Viet contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 20, 2026WP Hello Bar: Stored Cross-Site ScriptingCVE-2026-1042 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and including, 1.02 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Hello Bar
Affected
up to 1.02
What to do
Affects up to 1.02. Update WP Hello Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Jan 17, 2026Integrate Dynamics 365 CRM: Stored Cross-Site ScriptingCVE-2026-0725 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Integrate Dynamics 365 CRM
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Integrate Dynamics 365 CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 17, 2026CubeWP: Stored Cross-Site ScriptingCVE-2025-8615 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CubeWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cubewp_shortcode_taxonomy shortcode in all versions up to, and including, 1.1.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CubeWP
Affected
up to 1.1.26
What to do
Affects up to 1.1.26. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 17, 2026Team Section Block: Stored Cross-Site ScriptingCVE-2026-0833 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team Section Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user-supplied social network link URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Team Section Block
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Team Section Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 17, 2026CM E-Mail Blacklist – Simple email filtering for safer registration: Stored Cross-Site ScriptingCVE-2026-0691 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
CM E-Mail Blacklist – Simple email filtering for safer registration
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update CM E-Mail Blacklist – Simple email filtering for safer registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor: Arbitrary file readsCVE-2025-13725 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 1.0.1. This is due to insufficient path validation in the server-side rendering of the thim-blocks/icon block. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server via the 'iconSVG' parameter, which can contain sensitive information such as wp-config.php.
Product
Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Filr – Secure document library: Stored Cross-Site ScriptingCVE-2025-14632 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploader class. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload malicious HTML files containing JavaScript that will execute whenever a user accesses the uploaded file, granted they have permission to create or edit posts with the 'filr' post type.
Product
Filr – Secure document library
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update Filr – Secure document library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiCVE-2019-25297 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via multiple parameters due to insufficient input validation and output escaping. An unauthenticated attacker can inject arbitrary script into content that executes when a victim views an affected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org web.archive.org
Jan 16, 2026Essential Addons for Elementor: Sensitive Information ExposureCVE-2026-1004 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.
Product
Essential Addons for Elementor
Affected
up to 6.5.5
What to do
Affects up to 6.5.5. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 16, 2026User Submitted Posts – Enable Users to Submit Posts from the Front End: Stored Cross-Site ScriptingCVE-2026-0913 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'usp_access' shortcode in all versions up to, and including, 20260110 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
User Submitted Posts – Enable Users to Submit Posts from the Front End
Affected
up to 20260110
What to do
Affects up to 20260110. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Cost Calculator Builder: Unauthenticated Payment Status BypassCVE-2025-14757 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment.
Product
Cost Calculator Builder
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging: Reflected Cross-Site ScriptingCVE-2025-14375 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
Affected
up to 5.0.10
What to do
Affects up to 5.0.10. Update RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2026Related Posts by Taxonomy: Stored Cross-Site ScriptingCVE-2026-0916 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'related_posts_by_tax' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Related Posts by Taxonomy
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update Related Posts by Taxonomy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026LEAV Last Email Address Validator: Cross-Site Request ForgeryCVE-2025-14853 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions <= 1.7.1. This is due to missing or incorrect nonce validation on the display_settings_page function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
LEAV Last Email Address Validator
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update LEAV Last Email Address Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026DK PDF – WordPress PDF Generator: Server-Side Request ForgeryCVE-2025-14793 · WordPress plugins & themes · reported by WordfenceMedium 5
The DK PDF – WordPress PDF Generator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3.0 via the 'addContentToMpdf' function. This makes it possible for authenticated attackers, author level and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
DK PDF – WordPress PDF Generator
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update DK PDF – WordPress PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2026WP-Members Membership: Stored Cross-Site ScriptingCVE-2025-14448 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Select user profile fields in all versions up to, and including, 3.5.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Members Membership
Affected
up to 3.5.4.3
What to do
Affects up to 3.5.4.3. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2026Short Link: Stored Cross-Site ScriptingCVE-2026-0813 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Short Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'short_link_post_title' and 'short_link_page_title' parameters in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Product
Short Link
Affected
up to 1.0
What to do
Affects up to 1.0. Update Short Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026LinkedIn SC: Stored Cross-Site ScriptingCVE-2026-0812 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The LinkedIn SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'linkedin_sc_date_format', 'linkedin_sc_api_key', and 'linkedin_sc_secret_key' parameters in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Product
LinkedIn SC
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update LinkedIn SC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026Electric Studio Download Counter: Stored Cross-Site ScriptingCVE-2026-0741 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Electric Studio Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Electric Studio Download Counter
Affected
up to 2.4
What to do
Affects up to 2.4. Update Electric Studio Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026WMF Mobile Redirector: Stored Cross-Site ScriptingCVE-2026-0739 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WMF Mobile Redirector
Affected
up to 1.2
What to do
Affects up to 1.2. Update WMF Mobile Redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026WP Allowed Hosts: Stored Cross-Site ScriptingCVE-2026-0734 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Allowed Hosts
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update WP Allowed Hosts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026SearchWiz: Stored Cross-Site ScriptingCVE-2026-0694 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using `esc_attr()` instead of `esc_html()` when outputting post titles in search results. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in post titles that will execute whenever a user performs a search and views the search results page.
Product
SearchWiz
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update SearchWiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026Real Post Slider Lite: Stored Cross-Site ScriptingCVE-2026-0680 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Real Post Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Real Post Slider Lite
Affected
up to 2.4
What to do
Affects up to 2.4. Update Real Post Slider Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026List Site Contributors: Reflected Cross-Site ScriptingCVE-2026-0594 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
List Site Contributors
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update List Site Contributors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.