Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

699 results · page 6 of 14

Jun 28, 2025MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet: Cross-Site Request ForgeryCVE-2025-5937 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 24, 2025SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2025-5585 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in all versions up to, and including, 1.68.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SiteOrigin Widgets Bundle
Affected
up to 1.68.4
What to do
Affects up to 1.68.4. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Jun 7, 2025Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-9994 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_pricing_item_tooltip_content parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.1.12
What to do
Affects up to 6.1.12. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 7, 2025Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-9993 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_event_details_text parameter of Event Calendar Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.1.12
What to do
Affects up to 6.1.12. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 31, 2025Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder: Stored Cross-Site ScriptingCVE-2025-5292 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content’ parameter in all versions up to, and including, 5.11.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder
Affected
up to 5.11.2
What to do
Affects up to 5.11.2. Update Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 27, 2025Volunteer Sign Up Sheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-3704 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DBAR Productions Volunteer Sign Up Sheets pta-volunteer-sign-up-sheets allows Stored XSS.This issue affects Volunteer Sign Up Sheets: from n/a through < 5.5.5.
Product
Volunteer Sign Up Sheets
What to do
Update Volunteer Sign Up Sheets to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025My Custom Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janekniefeldt My Custom Widgets mycustomwidget allows Reflected XSS.This issue affects My Custom Widgets: from n/a through <= 2.0.5.
Product
My Custom Widgets
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update My Custom Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WordPress Events Calendar Registration & Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39372 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Reflected XSS.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
Product
WordPress Events Calendar Registration & Tickets
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WordPress Events Calendar Registration & Tickets: Deserialization of Untrusted DataCVE-2025-47581 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
Product
WordPress Events Calendar Registration & Tickets
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Embed and Integrate Etsy Shop: Missing AuthorizationCVE-2025-48346 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Embed360 Embed and Integrate Etsy Shop embed-and-integrate-etsy-shop allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embed and Integrate Etsy Shop: from n/a through <= 1.0.8.
Product
Embed and Integrate Etsy Shop
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Embed and Integrate Etsy Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Widgets Reset: Does not have CSRF check in placeCVE-2024-8082 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Widgets Reset
Affected
up to 0.1
What to do
Affects up to 0.1. Update Widgets Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Event Tickets with Ticket Scanner: Does not sanitise and escape some parametersCVE-2024-6711 · WordPress plugins & themes · reported by WPScanLow 3.5
The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks
Product
Event Tickets with Ticket Scanner
Fixed in
2.3.8
What to do
Update Event Tickets with Ticket Scanner to 2.3.8 or newer.
Full record and what to do →NVD record wpscan.com
May 8, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Arbitrary file readCVE-2025-3419 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.26
What to do
Affects up to 4.0.26. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 7, 2025Beacon Lead Magnets and Lead Capture: Cross-Site Request Forgery (CSRF)CVE-2025-47596 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Cross Site Request Forgery.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.8.
Product
Beacon Lead Magnets and Lead Capture
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Beacon Lead Magnets and Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 28, 2025WordPress Tag, Category, and Taxonomy Manager: Does not sanitise and escape some of its Widgets settingsCVE-2025-0627 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WordPress Tag, Category, and Taxonomy Manager
Fixed in
3.30.0
What to do
Update WordPress Tag, Category, and Taxonomy Manager to 3.30.0 or newer.
Full record and what to do →NVD record wpscan.com
Apr 26, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites
Affected
up to 5.10.29
What to do
Affects up to 5.10.29. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2025Verification SMS with TargetSMS: Limited Remote Code ExecutionCVE-2025-3776 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targetvr_ajax_handler' function. This is due to a lack of validation on the type of function that can be called. This makes it possible for unauthenticated attackers to execute any callable function on the site, such as phpinfo().
Product
Verification SMS with TargetSMS
Affected
up to 1.5
What to do
Affects up to 1.5. Update Verification SMS with TargetSMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2025My Tickets – Accessible Event Ticketing: Privilege EscalationCVE-2025-3761 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is due to the mt_save_profile() function not appropriately restricting access to unauthorized users to update roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator.
Product
My Tickets – Accessible Event Ticketing
Affected
up to 2.0.16
What to do
Affects up to 2.0.16. Update My Tickets – Accessible Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2025UiCore Elements – Free Elementor widgets and templates: Stored Cross-Site ScriptingCVE-2025-1054 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the UI Counter, UI Icon Box, UI Testimonial Slider, UI Testimonial Grid, and UI Testimonial Carousel widgets in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UiCore Elements – Free Elementor widgets and templates
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update UiCore Elements – Free Elementor widgets and templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 19, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1457 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Wrapper Link, Countdown and Gallery widgets in all versions up to, and including, 5.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites
Affected
up to 5.10.28
What to do
Affects up to 5.10.28. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2025Beacon Lead Magnets and Lead Capture: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24637 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Reflected XSS.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.7.
Product
Beacon Lead Magnets and Lead Capture
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Beacon Lead Magnets and Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Sign-up Sheets: Improper Control of Generation of Code ('Code Injection')CVE-2025-26996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Code Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.0.1.
Product
Sign-up Sheets
Affected
up to 2.3.0.1
What to do
Affects up to 2.3.0.1. Update Sign-up Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025SimplyRETS Real Estate IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31011 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.2.2.
Product
SimplyRETS Real Estate IDX
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 5, 2025MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy: Unauthorized loss of dataCVE-2025-2789 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_table_rate_shipping_row function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete Table Rates that can impact the shipping cost calculations.
Product
MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy
Affected
up to 4.2.19
What to do
Affects up to 4.2.19. Update MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 4, 2025Social Share Buttons & Analytics Plugin – GetSocial.io: Missing AuthorizationCVE-2025-32239 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joao Romao Social Share Buttons & Analytics Plugin – GetSocial.io wp-share-buttons-analytics-by-getsocial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Buttons & Analytics Plugin – GetSocial.io: from n/a through <= 4.5.
Product
Social Share Buttons & Analytics Plugin – GetSocial.io
Affected
up to 4.5
What to do
Affects up to 4.5. Update Social Share Buttons & Analytics Plugin – GetSocial.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025CF7 Spreadsheets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31536 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Reflected XSS.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.
Product
CF7 Spreadsheets
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025DigiWidgets Image Editor: Improper Control of Generation of Code ('Code Injection')CVE-2025-30580 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in kellydiek DigiWidgets Image Editor digiwidgets-image-editor allows Remote Code Inclusion.This issue affects DigiWidgets Image Editor: from n/a through <= 1.10.
Product
DigiWidgets Image Editor
Affected
up to 1.10
What to do
Affects up to 1.10. Update DigiWidgets Image Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Black Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31869 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets allows Stored XSS.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.9.
Product
Black Widgets For Elementor
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Black Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025PowerPack Elementor Addons (Free Widgets, Extensions and Templates): Stored Cross-Site ScriptingCVE-2025-1512 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Cursor Extension in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update PowerPack Elementor Addons (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2025Event Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30794 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through <= 5.20.0.
Product
Event Tickets
Affected
up to 5.20.0
What to do
Affects up to 5.20.0. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025CF7 Spreadsheets: Missing AuthorizationCVE-2025-31603 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.
Product
CF7 Spreadsheets
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Cryptocurrency Widgets Pack: Missing AuthorizationCVE-2025-31539 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Blocksera Cryptocurrency Widgets Pack cryptocurrency-widgets-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets Pack: from n/a through <= 2.0.1.
Product
Cryptocurrency Widgets Pack
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Cryptocurrency Widgets Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30963 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows DOM-Based XSS.This issue affects JetSmartFilters: from n/a through <= 3.6.3.
Product
JetSmartFilters
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update JetSmartFilters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31043 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.7.
Product
JetSearch
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025SimplyRETS Real Estate IDX: Cross-Site Request Forgery (CSRF)CVE-2025-31010 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.0.5.
Product
SimplyRETS Real Estate IDX
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025GetShop ecommerce: Path Traversal: '.../...//'CVE-2024-54362 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in boggibill GetShop ecommerce getshop-ecommerce allows Path Traversal.This issue affects GetShop ecommerce: from n/a through <= 1.3.
Product
GetShop ecommerce
Affected
up to 1.3
What to do
Affects up to 1.3. Update GetShop ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Event Tickets with Ticket Scanner: Does not have CSRF check in placeCVE-2025-1762 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Event Tickets with Ticket Scanner
Fixed in
2.5.4
What to do
Update Event Tickets with Ticket Scanner to 2.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2025Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: Missing AuthorizationCVE-2025-22667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Creative Werk Designs Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets wpsyncsheets-woocommerce.This issue affects Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: from n/a through <= 1.8.2.
Product
Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2025-30863 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-contact-form-7-and-google-sheets allows Cross Site Request Forgery.This issue affects Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.0.9.
Product
Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025GetSocial: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22283 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyaz GetSocial getsocial allows Reflected XSS.This issue affects GetSocial: from n/a through <= 2.0.1.
Product
GetSocial
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update GetSocial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 20, 2025140+ Widgets | Xpro Addons For Elementor – FREE: Stored Cross-Site ScriptingCVE-2025-2108 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'title_tag' and 'html_tag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
140+ Widgets | Xpro Addons For Elementor – FREE
Affected
up to 1.4.6.8
What to do
Affects up to 1.4.6.8. Update 140+ Widgets | Xpro Addons For Elementor – FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2025-1770 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.24
What to do
Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized modification of dataCVE-2025-1766 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.24
What to do
Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Custom Twitter Feeds – A Tweets Widget or X Feed Widget: Cross-Site Request ForgeryCVE-2025-1314 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Custom Twitter Feeds – A Tweets Widget or X Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025140+ Widgets | Xpro Addons For Elementor – FREE: Stored Cross-Site ScriptingCVE-2024-13649 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.4.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
140+ Widgets | Xpro Addons For Elementor – FREE
Affected
up to 1.4.6.7
What to do
Affects up to 1.4.6.7. Update 140+ Widgets | Xpro Addons For Elementor – FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Stored Cross-Site ScriptingCVE-2025-1287 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown, Syntax Highlighter, and Page Scroll widgets in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 6.2.2
What to do
Affects up to 6.2.2. Update The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025The Code Snippets CPT: Arbitrary shortcode executionCVE-2024-13895 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Code Snippets CPT plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
The Code Snippets CPT
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update The Code Snippets CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 6, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-13526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download list of attendees for any event.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 4.0.7.3
What to do
Affects up to 4.0.7.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2025-0433 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Affected
up to 2.0.7.1
What to do
Affects up to 2.0.7.1. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 4, 2025Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations: Stored Cross-Site ScriptingCVE-2024-9618 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Affected
up to 2.0.7.2
What to do
Affects up to 2.0.7.2. Update Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record master-addons.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.