Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
984 results · page 7 of 20
May 16, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.2.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.2
- What to do
- Affects up to 3.7.0.2. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Badgearoo: Does not sanitise and escape some of its settingsCVE-2025-1033 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Badgearoo
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Badgearoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-8619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ajax Search Lite
- Fixed in
- 4.12.3
- What to do
- Update Ajax Search Lite to 4.12.3 or newer.
May 15, 2025Badgearoo: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13828 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Badgearoo
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Badgearoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13128 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- LearnPress
- Fixed in
- 4.2.7.5.1
- What to do
- Update LearnPress to 4.2.7.5.1 or newer.
May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13127 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- LearnPress
- Fixed in
- 4.2.7.5.1
- What to do
- Update LearnPress to 4.2.7.5.1 or newer.
May 13, 2025Relevanssi – A Better Search: Time-based SQL InjectionCVE-2025-4396 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and <= 2.27.5 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.
- Product
- Relevanssi – A Better Search
- Affected
- up to 4.24.4
- What to do
- Affects up to 4.24.4. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2025Better Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47507 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allows DOM-Based XSS.This issue affects Better Search: from n/a through <= 4.1.0.
- Product
- Better Search
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025NGG Smart Image Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47503 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through <= 3.3.3.
- Product
- NGG Smart Image Search
- Affected
- up to 3.3.3
- What to do
- Affects up to 3.3.3. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025Relevanssi – A Better Search: Stored Cross-Site ScriptingCVE-2025-4054 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 (Free) and <= 2.27.4 (Premium), due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the search results.
- Product
- Relevanssi – A Better Search
- Affected
- up to 4.24.3
- What to do
- Affects up to 4.24.3. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 6, 2025Search Exclude: Unauthorized modification of dataCVE-2025-2821 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to modify plugin settings, excluding content from search results.
- Product
- Search Exclude
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Search Exclude to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 25, 2025JobSearch WP Job Board: Authentication bypassCVE-2024-11917 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.9.2. This is due to improper configurations in the 'jobsearch_xing_response_data_callback', 'set_access_tokes', and 'google_callback' functions. This makes it possible for unauthenticated attackers to log in as the first connected Xing user, or any connected Xing user if the Xing id is known. It is also possible for unauthenticated attackers to log in as the first connected Google user if the user has logged in, without subsequently logging out, in thirty days. The vulnerability was partially patched in version 2.8.4.
- Product
- JobSearch WP Job Board
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 24, 2025GNA Search Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46540 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Mok GNA Search Shortcode gna-search-shortcode allows Stored XSS.This issue affects GNA Search Shortcode: from n/a through <= 0.9.5.
- Product
- GNA Search Shortcode
- Affected
- up to 0.9.5
- What to do
- Affects up to 0.9.5. Update GNA Search Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025WP-Advanced-Search: Unrestricted Upload of File with Dangerous TypeCVE-2025-39538 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search wp-advanced-search allows Upload a Web Shell to a Web Server.This issue affects WP-Advanced-Search: from n/a through <= 3.3.9.4.
- Product
- WP-Advanced-Search
- Affected
- up to 3.3.9.4
- What to do
- Affects up to 3.3.9.4. Update WP-Advanced-Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Site Search 360: Cross-Site Request Forgery (CSRF)CVE-2025-39530 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dsky Site Search 360 site-search-360 allows Stored XSS.This issue affects Site Search 360: from n/a through <= 2.1.8.
- Product
- Site Search 360
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Site Search 360 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22268 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.1.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.1
- What to do
- Affects up to 3.7.0.1. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Advance WP Query Search Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26743 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Advance WP Query Search Filter advance-wp-query-search-filter allows Reflected XSS.This issue affects Advance WP Query Search Filter: from n/a through <= 1.0.10.
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13338 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfy_cache_delete functionality . This makes it possible for unauthenticated attackers to clear the cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the 'setup-wbcr_clearfy' page. This makes it possible for unauthenticated attackers to update the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.devplugins.trac.wordpress.org
Apr 10, 2025Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic: Missing AuthorizationCVE-2025-32236 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vagonic Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic vagonic-sortable.This issue affects Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic: from n/a through <= 1.9.
- Product
- Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Nearby Locations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32128 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL Injection.This issue affects Nearby Locations: from n/a through <= 1.1.1.
- Product
- Nearby Locations
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Nearby Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Advanced All in One Admin Search by WP Spotlight: Cross-Site Request Forgery (CSRF)CVE-2025-32261 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kuppuraj Advanced All in One Admin Search by WP Spotlight wp-spotlight-search allows Cross Site Request Forgery.This issue affects Advanced All in One Admin Search by WP Spotlight: from n/a through <= 1.1.1.
- Product
- Advanced All in One Admin Search by WP Spotlight
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Advanced All in One Admin Search by WP Spotlight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 20251 Click WordPress Migration: Exposure of Sensitive System Information Due to Uncleared Debug InformationCVE-2025-32257 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allows Retrieve Embedded Sensitive Data.This issue affects 1 Click WordPress Migration: from n/a through <= 2.5.7.
- Product
- 1 Click WordPress Migration
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update 1 Click WordPress Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Search, Filters & Merchandising for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32181 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fast Simon Search, Filters & Merchandising for WooCommerce instantsearch-for-woocommerce allows Stored XSS.This issue affects Search, Filters & Merchandising for WooCommerce: from n/a through <= 3.0.58.
- Product
- Search, Filters & Merchandising for WooCommerce
- Affected
- up to 3.0.58
- What to do
- Affects up to 3.0.58. Update Search, Filters & Merchandising for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025VK Filter Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32175 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Filter Search vk-filter-search allows Stored XSS.This issue affects VK Filter Search: from n/a through <= 2.20.2.
- Product
- VK Filter Search
- Affected
- up to 2.20.2
- What to do
- Affects up to 2.20.2. Update VK Filter Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Search engine keywords highlighter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31442 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e1tekoap42 Search engine keywords highlighter keywords-highlight-tool allows Reflected XSS.This issue affects Search engine keywords highlighter: from n/a through <= 0.1.3.
- Product
- Search engine keywords highlighter
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Search engine keywords highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2025Advanced Search by My Solr Server: Cross-Site Request ForgeryCVE-2025-3099 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced Search by My Solr Server plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the 'MySolrServerSettings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Advanced Search by My Solr Server
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Advanced Search by My Solr Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 1, 2025Actionwear products sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31619 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows SQL Injection.This issue affects Actionwear products sync: from n/a through <= 2.3.3.
- Product
- Actionwear products sync
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Actionwear products sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025AI Search Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vimal Kava AI Search Bar open-ai-search-bar allows Stored XSS.This issue affects AI Search Bar: from n/a through <= 2.1.
- Product
- AI Search Bar
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update AI Search Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Pearl: Missing AuthorizationCVE-2025-31881 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Stylemix Pearl pearl-header-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pearl: from n/a through <= 1.3.9.
- Product
- Pearl
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Pearl: Cross-Site Request Forgery (CSRF)CVE-2025-31880 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stylemix Pearl pearl-header-builder allows Cross Site Request Forgery.This issue affects Pearl: from n/a through <= 1.3.9.
- Product
- Pearl
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Clearbit Reveal: Cross-Site Request Forgery (CSRF)CVE-2025-31785 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Clearbit Clearbit Reveal clearbit allows Cross Site Request Forgery.This issue affects Clearbit Reveal: from n/a through <= 1.0.6.
- Product
- Clearbit Reveal
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Clearbit Reveal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Leartes TRY Exchange Rates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31783 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leartes.NET Leartes TRY Exchange Rates leartes-try-exchange-rates allows Stored XSS.This issue affects Leartes TRY Exchange Rates: from n/a through <= 2.1.
- Product
- Leartes TRY Exchange Rates
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Leartes TRY Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Advanced Post Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VarDump s.r.l. Advanced Post Search advanced-post-search allows Reflected XSS.This issue affects Advanced Post Search: from n/a through <= 1.1.0.
- Product
- Advanced Post Search
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Advanced Post Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31043 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.7.
- Product
- JetSearch
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025Clear Sucuri Cache: Missing AuthorizationCVE-2025-31469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in webrangers Clear Sucuri Cache clear-sucuri-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clear Sucuri Cache: from n/a through <= 1.4.
- Product
- Clear Sucuri Cache
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Clear Sucuri Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025WP Ultimate Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31452 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mindshare Labs, Inc. WP Ultimate Search wp-ultimate-search allows Stored XSS.This issue affects WP Ultimate Search: from n/a through <= 2.0.3.
- Product
- WP Ultimate Search
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update WP Ultimate Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025LearnPress: Missing AuthorizationCVE-2025-22739 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through <= 4.2.7.5.
- Product
- LearnPress
- Affected
- up to 4.2.7.5
- What to do
- Affects up to 4.2.7.5. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WP Fast Total Search: Missing AuthorizationCVE-2025-30894 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.79.262.
- Product
- WP Fast Total Search
- Affected
- up to 1.79.262
- What to do
- Affects up to 1.79.262. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025SearchIQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ searchiq allows Stored XSS.This issue affects SearchIQ: from n/a through <= 4.7.
- Product
- SearchIQ
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Clearout Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30789 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in clearoutio Clearout Email Validator clearout-email-validator allows Stored XSS.This issue affects Clearout Email Validator: from n/a through <= 3.2.0.
- Product
- Clearout Email Validator
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Clearout Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Fiverr.com Official Search Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28885 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fiverraffiliates Fiverr.com Official Search Box fiverr-official-search-box allows Stored XSS.This issue affects Fiverr.com Official Search Box: from n/a through <= 1.0.8.
- Product
- Fiverr.com Official Search Box
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Fiverr.com Official Search Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Pearl - Corporate Business: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26986 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through < 3.4.8.
- Product
- Pearl - Corporate Business
- What to do
- Update Pearl - Corporate Business to the newest version.
Mar 25, 2025Advanced Woo Search: Stored Cross-Site ScriptingCVE-2025-2302 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aws_search_terms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Advanced Woo Search
- Affected
- up to 3.28
- What to do
- Affects up to 3.28. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2025WordPress WP-Advanced-Search: Does not sanitise and escape some of its settingsCVE-2024-10554 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WordPress WP-Advanced-Search
- Fixed in
- 3.3.9.3
- What to do
- Update WordPress WP-Advanced-Search to 3.3.9.3 or newer.
Mar 19, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Unauthenticated Post TrashingCVE-2025-2290 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
- Product
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- Affected
- up to 8.0.1
- What to do
- Affects up to 8.0.1. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 14, 2025Search & Filter Pro: Unauthorized access of dataCVE-2025-1528 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function in all versions up to, and including, 2.5.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the values of arbitrary post meta.
- Product
- Search & Filter Pro
- Affected
- up to 2.5.19
- What to do
- Affects up to 2.5.19. Update Search & Filter Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsearchandfilter.comwordfence.com
Mar 11, 2025Lava Ajax Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28937 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored XSS.This issue affects Lava Ajax Search: from n/a through <= 1.1.9.
- Product
- Lava Ajax Search
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Lava Ajax Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2025Years Since – Timeless Texts: Stored Cross-Site ScriptingCVE-2024-12460 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Years Since – Timeless Texts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'years-since' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Years Since – Timeless Texts
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Years Since – Timeless Texts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 5, 2025SearchIQ – The Search Solution: Stored Cross-Site ScriptingCVE-2024-13350 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SearchIQ – The Search Solution
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update SearchIQ – The Search Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.