Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,327 results · page 7 of 27
May 15, 2025jwp-a11y: Does not sanitise and escape some of its settingsCVE-2024-11190 · WordPress plugins & themes · reported by WPScanMedium 4.8
The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- jwp-a11y
- Affected
- up to 4.1.7
- What to do
- Affects up to 4.1.7. Update jwp-a11y to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Social Share And Social Locker: Does not sanitise and escape some of its settingsCVE-2024-11189 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Social Share And Social Locker
- Fixed in
- 1.4.2
- What to do
- Update Social Share And Social Locker to 1.4.2 or newer.
May 15, 2025Sailthru Triggermail: Does not sanitise and escape some of its settings and is missing CSRF protectionCVE-2024-11141 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscribers to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Real WP Shop Lite Ajax eCommerce Shopping Cart: Does not sanitise and escape some of its settingsCVE-2024-11140 · WordPress plugins & themes · reported by WPScanLow 3.5
The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Real WP Shop Lite Ajax eCommerce Shopping Cart
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Real WP Shop Lite Ajax eCommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2024-11109 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Google Review Slider
- Fixed in
- 15.6
- What to do
- Update WP Google Review Slider to 15.6 or newer.
May 15, 2025Auto Prune Posts: Does not sanitise and escape some of its settingsCVE-2024-10639 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Auto Prune Posts
- Fixed in
- 3.0.0
- What to do
- Update Auto Prune Posts to 3.0.0 or newer.
May 15, 2025Nokaut Offers Box: Does not sanitize and escape some of its settingsCVE-2024-10632 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Nokaut Offers Box
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Nokaut Offers Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Responsive Contact Form Builder & Lead Generation: Does not sanitise and escape some of its settingsCVE-2024-10475 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Responsive Contact Form Builder & Lead Generation
- Fixed in
- 1.9.8
- What to do
- Update Responsive Contact Form Builder & Lead Generation to 1.9.8 or newer.
May 15, 2025Social Media Share Buttons & Social Sharing Icons: Does not sanitize and escape some of its settingsCVE-2024-10362 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Media Share Buttons & Social Sharing Icons
- Fixed in
- 2.9.1
- What to do
- Update Social Media Share Buttons & Social Sharing Icons to 2.9.1 or newer.
May 15, 2025Social Slider Feed: Does not sanitise and escape some of its settingsCVE-2024-10149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Social Slider Feed
- Fixed in
- 2.2.9
- What to do
- Update Social Slider Feed to 2.2.9 or newer.
May 15, 2025Hubbub Lite: Does not sanitise and escape some of its settingsCVE-2024-10145 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Hubbub Lite
- Fixed in
- 1.34.4
- What to do
- Update Hubbub Lite to 1.34.4 or newer.
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-10144 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.22
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
May 15, 2025MB Custom Post Types & Custom Taxonomies: Does not sanitise and escape some of its settingsCVE-2024-10143 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MB Custom Post Types & Custom Taxonomies
- Fixed in
- 2.7.7
- What to do
- Update MB Custom Post Types & Custom Taxonomies to 2.7.7 or newer.
May 15, 2025Giveaways and Contests by RafflePress: Does not sanitise and escape some of its settingsCVE-2024-10107 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.12.17
- What to do
- Update Giveaways and Contests by RafflePress to 1.12.17 or newer.
May 15, 2025Happyforms: Does not sanitise and escape some of its settingsCVE-2024-10054 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Happyforms
- Fixed in
- 1.26.3
- What to do
- Update Happyforms to 1.26.3 or newer.
May 15, 2025Better Follow Button for Jetpack: Does not sanitise and escape some of its settingsCVE-2023-7168 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Better Follow Button for Jetpack
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Better Follow Button for Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WolfNet IDX for: Does not sanitise and escape some of its settingsCVE-2023-6783 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WolfNet IDX for
- Affected
- up to 1.19.1
- What to do
- Affects up to 1.19.1. Update WolfNet IDX for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Advanced Page Visit Counter: Does not sanitise and escape some of its settingsCVE-2023-5529 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Page Visit Counter
- Fixed in
- 8.0.6
- What to do
- Update Advanced Page Visit Counter to 8.0.6 or newer.
May 5, 2025Newsletter: Does not sanitise and escape some of its settingsCVE-2025-3583 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Newsletter
- Fixed in
- 8.7.1
- What to do
- Update Newsletter to 8.7.1 or newer.
May 2, 2025Database Toolset: Sensitive Information ExposureCVE-2025-4222 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This makes it possible for unauthenticated attackers to extract sensitive data from database backup files. An index file is present, so a brute force attack would need to be successful in order to compromise any data.
- Product
- Database Toolset
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2025SureForms: Does not sanitise and escape some of its Form settingsCVE-2025-3514 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SureForms
- Fixed in
- 1.4.4
- What to do
- Update SureForms to 1.4.4 or newer.
May 2, 2025SureForms: Does not sanitise and escape some of its Form settingsCVE-2025-3513 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SureForms
- Fixed in
- 1.4.4
- What to do
- Update SureForms to 1.4.4 or newer.
May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_secCVE-2024-13420 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3504 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3503 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025WP Maps: Does not sanitise and escape some of its Map settingsCVE-2025-3502 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Maps
- Fixed in
- 4.7.2
- What to do
- Update WP Maps to 4.7.2 or newer.
May 1, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-13381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.62
- What to do
- Update Calculated Fields Form to 5.2.62 or newer.
Apr 29, 2025Calculated Fields Form: Does not sanitise and escape some of its settingsCVE-2024-12273 · WordPress plugins & themes · reported by WPScanLow 3.5
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Calculated Fields Form
- Fixed in
- 5.2.62
- What to do
- Update Calculated Fields Form to 5.2.62 or newer.
Apr 28, 2025WordPress Tag, Category, and Taxonomy Manager: Does not sanitise and escape some of its Widgets settingsCVE-2025-0627 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WordPress Tag, Category, and Taxonomy Manager
- Fixed in
- 3.30.0
- What to do
- Update WordPress Tag, Category, and Taxonomy Manager to 3.30.0 or newer.
Apr 28, 2025WP-Recall: Does not sanitise and escape some of its settingsCVE-2024-9771 · WordPress plugins & themes · reported by WPScanLow 3.5
The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP-Recall
- Fixed in
- 16.26.12
- What to do
- Update WP-Recall to 16.26.12 or newer.
Apr 25, 2025Icegram Express: Does not sanitise and escape some of its Template settingsCVE-2025-0671 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Express
- Fixed in
- 5.7.50
- What to do
- Update Icegram Express to 5.7.50 or newer.
Apr 24, 2025Database Toolset: Arbitrary file deletionCVE-2025-3065 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Database Toolset
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 24, 2025Category Posts Widget: Does not sanitise and escape some of its settingsCVE-2025-1453 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Category Posts Widget
- Fixed in
- 4.9.20
- What to do
- Update Category Posts Widget to 4.9.20 or newer.
Apr 18, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2025-2162 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- MapPress Maps for
- Fixed in
- 2.94.10
- What to do
- Update MapPress Maps for to 2.94.10 or newer.
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1525 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ultimate Dashboard
- Fixed in
- 3.8.6
- What to do
- Update Ultimate Dashboard to 3.8.6 or newer.
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1524 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ultimate Dashboard
- Fixed in
- 3.8.6
- What to do
- Update Ultimate Dashboard to 3.8.6 or newer.
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1523 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ultimate Dashboard
- Fixed in
- 3.8.6
- What to do
- Update Ultimate Dashboard to 3.8.6 or newer.
Apr 17, 2025Icegram Express formerly known as Email Subscribers: Does not sanitise and escape some of its settingsCVE-2024-11924 · WordPress plugins & themes · reported by WPScanLow 3.5
The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Icegram Express formerly known as Email Subscribers
- Fixed in
- 5.7.52
- What to do
- Update Icegram Express formerly known as Email Subscribers to 5.7.52 or newer.
Apr 16, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10680 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.32
- What to do
- Update Form Maker by 10Web to 1.15.32 or newer.
Apr 15, 2025Simple Social Media Share Buttons: Does not sanitise and escape some of its settingsCVE-2024-13610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Social Media Share Buttons
- Fixed in
- 6.0.0
- What to do
- Update Simple Social Media Share Buttons to 6.0.0 or newer.
Apr 15, 2025Widget for Social Page Feeds: Does not sanitise and escape some of its settingsCVE-2024-13207 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Widget for Social Page Feeds
- Fixed in
- 6.4.2
- What to do
- Update Widget for Social Page Feeds to 6.4.2 or newer.
Apr 14, 2025User Registration & Membership: Does not prevent users to set their account roleCVE-2025-2563 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
- Product
- User Registration & Membership
- Fixed in
- 4.1.2
- What to do
- Update User Registration & Membership to 4.1.2 or newer.
Apr 14, 2025PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its settingsCVE-2024-9230 · WordPress plugins & themes · reported by WPScanMedium 5.9
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks
- Product
- PowerPress Podcasting plugin by Blubrry
- Fixed in
- 11.9.18
- What to do
- Update PowerPress Podcasting plugin by Blubrry to 11.9.18 or newer.
Apr 11, 2025Database Toolset: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32633 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in neoslab Database Toolset database-toolset allows Path Traversal.This issue affects Database Toolset: from n/a through <= 1.8.4.
- Product
- Database Toolset
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Flickr set slideshows: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30589 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9.
- Product
- Flickr set slideshows
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Flickr set slideshows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Smart Maintenance Mode: Does not sanitise and escape some of its settingsCVE-2024-12683 · WordPress plugins & themes · reported by WPScanLow 3.5
The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Smart Maintenance Mode
- Fixed in
- 1.5.2
- What to do
- Update Smart Maintenance Mode to 1.5.2 or newer.
Mar 25, 2025Favorites: Does not sanitise and escape some of its settingsCVE-2025-1452 · WordPress plugins & themes · reported by WPScanLow 3.5
The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Favorites
- Fixed in
- 2.3.5
- What to do
- Update Favorites to 2.3.5 or newer.
Mar 25, 2025AFI: Does not sanitise and escape some of its settingsCVE-2024-13123 · WordPress plugins & themes · reported by WPScanLow 3.5
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AFI
- Fixed in
- 1.100.0
- What to do
- Update AFI to 1.100.0 or newer.
Mar 25, 2025AFI: Does not sanitise and escape some of its settingsCVE-2024-13122 · WordPress plugins & themes · reported by WPScanLow 3.5
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AFI
- Fixed in
- 1.100.0
- What to do
- Update AFI to 1.100.0 or newer.
Mar 25, 2025Simple Banner: Does not sanitise and escape some of its settingsCVE-2024-12769 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Banner
- Fixed in
- 3.0.4
- What to do
- Update Simple Banner to 3.0.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.