Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,408 results · page 68 of 389
May 15, 2025RegistrationMagic: Does not sanitise and escape some of its settingsCVE-2024-9390 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- RegistrationMagic
- Fixed in
- 6.0.2.1
- What to do
- Update RegistrationMagic to 6.0.2.1 or newer.
May 15, 2025AVIF Uploader: Does not sanitise uploaded SVG filesCVE-2024-9238 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- AVIF Uploader
- Fixed in
- 1.1.1
- What to do
- Update AVIF Uploader to 1.1.1 or newer.
May 15, 2025Team: Does not sanitise and escape some of its settingsCVE-2024-9236 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Team
- Fixed in
- 4.4.2
- What to do
- Update Team to 4.4.2 or newer.
May 15, 2025Logo Slider: Does not have CSRF check in placeCVE-2024-9233 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Logo Slider
- Fixed in
- 3.7.1
- What to do
- Update Logo Slider to 3.7.1 or newer.
May 15, 2025PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its settingsCVE-2024-9227 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- PowerPress Podcasting plugin by Blubrry
- Fixed in
- 11.9.18
- What to do
- Update PowerPress Podcasting plugin by Blubrry to 11.9.18 or newer.
May 15, 2025Maspik: Does not sanitise and escape some of its settingsCVE-2024-9182 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Maspik
- Fixed in
- 2.1.3
- What to do
- Update Maspik to 2.1.3 or newer.
May 15, 2025Polls CP: Does not sanitise and escape some of its poll settingsCVE-2024-8854 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
- Product
- Polls CP
- Fixed in
- 1.0.77
- What to do
- Update Polls CP to 1.0.77 or newer.
May 15, 2025Polls CP: Does not sanitise and escape some of its poll settingsCVE-2024-8851 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
- Product
- Polls CP
- Fixed in
- 1.0.77
- What to do
- Update Polls CP to 1.0.77 or newer.
May 15, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2024-8759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Nested Pages
- Fixed in
- 3.2.9
- What to do
- Update Nested Pages to 3.2.9 or newer.
May 15, 2025Z-Downloads: Does not sanitise and escape some parametersCVE-2024-8703 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs.
- Product
- Z-Downloads
- Fixed in
- 1.11.6
- What to do
- Update Z-Downloads to 1.11.6 or newer.
May 15, 2025Backup Database: Does not sanitise and escape some of its settingsCVE-2024-8702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Backup Database
- Affected
- up to 4.9
- What to do
- Affects up to 4.9. Update Backup Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025events-calendar: Does not sanitise and escape some of its settingsCVE-2024-8701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The events-calendar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- events-calendar
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update events-calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Event Calendar: Does not check for authorization on delete actionsCVE-2024-8700 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.
- Product
- Event Calendar
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Z-Downloads: Does not properly validate files uploadedCVE-2024-8699 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- Z-Downloads
- Fixed in
- 1.11.5
- What to do
- Update Z-Downloads to 1.11.5 or newer.
May 15, 2025Z-Downloads: Does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScriptCVE-2024-8673 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.
- Product
- Z-Downloads
- Fixed in
- 1.11.7
- What to do
- Update Z-Downloads to 1.11.7 or newer.
May 15, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-8670 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.8.29
- What to do
- Update Photo Gallery by 10Web to 1.8.29 or newer.
May 15, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2024-8620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MapPress Maps for
- Fixed in
- 2.93
- What to do
- Update MapPress Maps for to 2.93 or newer.
May 15, 2025Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-8619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ajax Search Lite
- Fixed in
- 4.12.3
- What to do
- Update Ajax Search Lite to 4.12.3 or newer.
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.9.0
- What to do
- Update Page Builder: Pagelayer to 1.9.0 or newer.
May 15, 2025Quiz Maker: Does not sanitize and escape some of its settingsCVE-2024-8617 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Quiz Maker
- Fixed in
- 6.5.9.9
- What to do
- Update Quiz Maker to 6.5.9.9 or newer.
May 15, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-8542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Everest Forms
- Fixed in
- 3.0.3.1
- What to do
- Update Everest Forms to 3.0.3.1 or newer.
May 15, 2025Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-8493 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Events Calendar
- Fixed in
- 6.6.4
- What to do
- Update Events Calendar to 6.6.4 or newer.
May 15, 2025Hustle: Does not sanitise and escape some of its settingsCVE-2024-8492 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Hustle
- Affected
- up to 7.8.5
- What to do
- Affects up to 7.8.5. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2024-8426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.8
- What to do
- Update Page Builder: Pagelayer to 1.8.8 or newer.
May 15, 2025Simple Nav Archives: Does not have CSRF check in placeCVE-2024-8398 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Simple Nav Archives
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Simple Nav Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025webtoffee-gdpr-cookie-consent: Does not properly sanitize and escape the IP headersCVE-2024-8397 · WordPress plugins & themes · reported by WPScanMedium 5.4
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.
- Product
- webtoffee-gdpr-cookie-consent
- Fixed in
- 2.6.1
- What to do
- Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
May 15, 2025webtoffee-gdpr-cookie-consent: Does not have CSRF checks in some bulk actionsCVE-2024-8286 · WordPress plugins & themes · reported by WPScanMedium 6.5
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks
- Product
- webtoffee-gdpr-cookie-consent
- Fixed in
- 2.6.1
- What to do
- Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
May 15, 2025Download Manager: Does not sanitise and escape some of its settingsCVE-2024-8284 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Download Manager
- Fixed in
- 3.2.99
- What to do
- Update Download Manager to 3.2.99 or newer.
May 15, 2025GamiPress: Does not have CSRF check in placeCVE-2024-8245 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- GamiPress
- Fixed in
- 1.0.1
- What to do
- Update GamiPress to 1.0.1 or newer.
May 15, 2025Smart Post Show: Does not sanitise and escape some of its settingsCVE-2024-8187 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Smart Post Show
- Fixed in
- 3.0.1
- What to do
- Update Smart Post Show to 3.0.1 or newer.
May 15, 2025BabelZ: Does not have CSRF check in some placesCVE-2024-8095 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- BabelZ
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update BabelZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Ntz Antispam: Does not have CSRF check in placeCVE-2024-8094 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Ntz Antispam
- Affected
- up to 2.0e
- What to do
- Affects up to 2.0e. Update Ntz Antispam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025JavaScript Logic: Does not have CSRF check in some placesCVE-2024-8090 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- JavaScript Logic
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update JavaScript Logic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PeoplePond: Does not have CSRF check in some placesCVE-2024-8085 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- PeoplePond
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update PeoplePond to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Widgets Reset: Does not have CSRF check in placeCVE-2024-8082 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Widgets Reset
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Widgets Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Custom Author Base: Does not have CSRF check in placeCVE-2024-8050 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Custom Author Base
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Custom Author Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Smooth Gallery Replacement: Does not have CSRF check in some placesCVE-2024-8032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Smooth Gallery Replacement
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Smooth Gallery Replacement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Secure Downloads: Is vulnerable does not properly restrictCVE-2024-8031 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php.
- Product
- Secure Downloads
- Fixed in
- 1.2.3
- What to do
- Update Secure Downloads to 1.2.3 or newer.
May 15, 2025Joy Of Text Lite: Does not have CSRF check in placeCVE-2024-7984 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Joy Of Text Lite
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Joy Of Text Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025ClickSold IDX: Does not sanitise and escape some of its settingsCVE-2024-7769 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- ClickSold IDX
- Affected
- up to 1.90
- What to do
- Affects up to 1.90. Update ClickSold IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Simple Job Board: Does not prevent uploaded files from being listedCVE-2024-7762 · WordPress plugins & themes · reported by WPScanLow 3.7
The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes
- Product
- Simple Job Board
- Fixed in
- 2.12.6
- What to do
- Update Simple Job Board to 2.12.6 or newer.
May 15, 2025PWA for WP: Does not sanitise and escape some of its settingsCVE-2024-7759 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- PWA for WP
- Fixed in
- 1.7.72
- What to do
- Update PWA for WP to 1.7.72 or newer.
May 15, 2025Stylish Price List: Does not sanitise and escape some of its settingsCVE-2024-7758 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Stylish Price List
- Fixed in
- 7.1.8
- What to do
- Update Stylish Price List to 7.1.8 or newer.
May 15, 2025Simple Share: Does not sanitise and escape some of its settingsCVE-2024-7556 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Share
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update Simple Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Simple Video Directory: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6809 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Simple Video Directory
- Fixed in
- 1.4.3
- What to do
- Update Simple Video Directory to 1.4.3 or newer.
May 15, 2025DL Verification: Does not sanitise and escape some of its settingsCVE-2024-6798 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Verification
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025DL Robots.txt: Does not sanitise and escape some of its settingsCVE-2024-6797 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- DL Robots.txt
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DL Robots.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Offload Videos: Does not have CSRF check in placeCVE-2024-6719 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack
- Product
- Offload Videos
- Fixed in
- 1.0.1
- What to do
- Update Offload Videos to 1.0.1 or newer.
May 15, 2025PVN Auth Popup: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025PVN Auth Popup: Does not sanitise and escape some of its settingsCVE-2024-6713 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.