Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

465new WordPress flaws this week

393,150entries in the database

15,398 results · page 91 of 308

Oct 10, 2025The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the ‘cs_job_title’ parameter in all versions CVE-2025-7781 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the ‘cs_job_title’ parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Candidate-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 7.6
What to do
Affects up to 7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 9, 2025Betheme: Stored Cross-Site ScriptingCVE-2025-9371 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_title’ parameter in all versions up to, and including, 28.1.6 due to insufficient input sanitization and output escaping of theme breadcrumbs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Betheme
Affected
up to 28.1.6
What to do
Affects up to 28.1.6. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 9, 2025Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers: SQL InjectionCVE-2025-10862 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2025Cookie Notice & Consent: Stored Cross-Site ScriptingCVE-2025-10496 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cookie Notice & Consent
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Cookie Notice & Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2025Motors – Car Dealership & Classified Listings: Arbitrary file deletionCVE-2025-10494 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.89
What to do
Affects up to 1.4.89. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 7, 2025Featured Image from URL (FIFU): Stored Cross-Site ScriptingCVE-2025-7400 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.
Product
Featured Image from URL (FIFU)
Affected
up to 5.2.7
Fixed in
5.2.2
What to do
Update Featured Image from URL (FIFU) to 5.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 4, 2025Trinity Audio – Text to Speech AI audio player to convert content into audio: Reflected Cross-Site ScriptingCVE-2025-9952 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Trinity Audio – Text to Speech AI audio player to convert content into audio
Affected
up to 5.20.2
What to do
Affects up to 5.20.2. Update Trinity Audio – Text to Speech AI audio player to convert content into audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2025Contest Gallery – Upload, Vote & Sell with PayPal and Stripe: Stored Cross-Site ScriptingCVE-2025-10383 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field parameters in all versions up to, and including, 27.0.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with author-level access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe
Affected
up to 27.0.2
What to do
Affects up to 27.0.2. Update Contest Gallery – Upload, Vote & Sell with PayPal and Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Majestic Before After Image: Stored Cross-Site ScriptingCVE-2025-9030 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label' and 'after_label' parameters in versions less than, or equal to, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Majestic Before After Image
What to do
Update Majestic Before After Image to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025WP Photo Album Plus: Cross-Site ScriptingCVE-2025-8726 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppa_user_upload function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in the photo album descriptions that execute in a victim's browser.
Product
WP Photo Album Plus
Affected
up to 9.0.11.006
What to do
Affects up to 9.0.11.006. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Ird Slider: Stored Cross-Site ScriptingCVE-2025-9876 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ird Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irdslider' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ird Slider
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Ird Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025Event Tickets, RSVPs, Calendar: Stored Cross-Site ScriptingCVE-2025-9875 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticket_spot' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Event Tickets, RSVPs, Calendar
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Event Tickets, RSVPs, Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Fintelligence Calculator: Stored Cross-Site ScriptingCVE-2025-9859 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fintelligence Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fintelligence-calculator' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Fintelligence Calculator
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Fintelligence Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025Auto Bulb Finder for: Stored Cross-Site ScriptingCVE-2025-9858 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_vehicle' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Auto Bulb Finder for
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Auto Bulb Finder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025A Simple Multilanguage: Stored Cross-Site ScriptingCVE-2025-9854 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-switcher' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
A Simple Multilanguage
Affected
up to 1.0
What to do
Affects up to 1.0. Update A Simple Multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025Ultimate Multi Design Video Carousel: Stored Cross-Site ScriptingCVE-2025-9372 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Ultimate Multi Design Video Carousel
Affected
up to 1.4
What to do
Affects up to 1.4. Update Ultimate Multi Design Video Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 3, 2025Smart Docs: Stored Cross-Site ScriptingCVE-2025-9333 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Smart Docs
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Smart Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 3, 2025Interactive Human Anatomy with Clickable Body Parts: Stored Cross-Site ScriptingCVE-2025-9332 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Interactive Human Anatomy with Clickable Body Parts
Affected
up to 2.6
What to do
Affects up to 2.6. Update Interactive Human Anatomy with Clickable Body Parts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 3, 2025Meks Easy Maps: Stored Cross-Site ScriptingCVE-2025-9206 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the map containing the malicious post.
Product
Meks Easy Maps
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Meks Easy Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025X Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-9204 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The X Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Youtube Video ID field in all versions up to, and including, 1.0.16. This is due to insufficient input sanitization and output escaping on the Youtube Video ID parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.
Product
X Addons for Elementor
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update X Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Unify: Stored Cross-Site ScriptingCVE-2025-9130 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unify_checkout shortcode in all versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Unify
Affected
up to 3.4.7
What to do
Affects up to 3.4.7. Update Unify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Flexi: Stored Cross-Site ScriptingCVE-2025-9129 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flexi
Affected
up to 4.28
What to do
Affects up to 4.28. Update Flexi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 3, 2025Generic Elements: Stored Cross-Site ScriptingCVE-2025-9080 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Generic Elements
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Generic Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Ultra Addons Lite for Elementor: Stored Cross-Site ScriptingCVE-2025-9077 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in version 1.1.9 and below due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultra Addons Lite for Elementor
What to do
Update Ultra Addons Lite for Elementor to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Easy Elementor Addons: Stored Cross-Site ScriptingCVE-2025-9045 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Elementor Addons
What to do
Update Easy Elementor Addons to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Epic Bootstrap Buttons: Stored Cross-Site ScriptingCVE-2025-8776 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Epic Bootstrap Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icol’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Epic Bootstrap Buttons
Affected
up to 1.0
What to do
Affects up to 1.0. Update Epic Bootstrap Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Oct 3, 2025WP Photo Effects: Stored Cross-Site ScriptingCVE-2025-10192 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Photo Effects
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update WP Photo Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 3, 2025AP Background: Stored Cross-Site ScriptingCVE-2025-10165 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back' shortcode in all versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AP Background
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update AP Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 3, 2025TableGen – Data Table Generator: Stored Cross-Site ScriptingCVE-2025-10053 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
TableGen – Data Table Generator
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update TableGen – Data Table Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 2, 2025Yoast SEO Premium: Stored Cross-Site ScriptingCVE-2025-11241 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.
Product
Yoast SEO Premium
Affected
25.7 to 25.9
What to do
Affects 25.7 to 25.9. Update Yoast SEO Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.yoast.com sec.stealthcopter.com
Oct 1, 2025ZoloBlocks: Stored Cross-Site ScriptingCVE-2025-9075 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to, and including, 2.3.10. This is due to insufficient input sanitization and output escaping on user-supplied attributes within multiple block components including Google Maps markers, Lightbox captions, Image Gallery data attributes, Progress Pie prefix/suffix fields, and Text Path URL fields. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ZoloBlocks
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update ZoloBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025Tiny Bootstrap Elements Light: Local File InclusionCVE-2025-9991 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
Tiny Bootstrap Elements Light
Affected
up to 4.3.34
What to do
Affects up to 4.3.34. Update Tiny Bootstrap Elements Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025Yoga Schedule Momoyoga: Stored Cross-Site ScriptingCVE-2025-9852 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yoga Schedule Momoyoga plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'momoyoga-schedule' shortcode in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Yoga Schedule Momoyoga
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Yoga Schedule Momoyoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025planetcalc: Stored Cross-Site ScriptingCVE-2025-8777 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The planetcalc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘language’ parameter in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
planetcalc
Affected
up to 2.2
What to do
Affects up to 2.2. Update planetcalc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 30, 2025Nexa Blocks: Stored Cross-Site ScriptingCVE-2025-8624 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Nexa Blocks
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Nexa Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 30, 2025WeedMaps Menu for: Stored Cross-Site ScriptingCVE-2025-8623 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WeedMaps Menu for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's weedmaps_menu shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WeedMaps Menu for
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WeedMaps Menu for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 30, 2025Mihdan: Elementor Yandex Maps: Stored Cross-Site ScriptingCVE-2025-8608 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mihdan: Elementor Yandex Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 1.6.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mihdan: Elementor Yandex Maps
Affected
up to 1.6.11
What to do
Affects up to 1.6.11. Update Mihdan: Elementor Yandex Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 30, 2025GutenBee – Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2025-8566 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameters in the CountUp and Google Maps Blocks in all versions up to, and including, 2.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GutenBee – Gutenberg Blocks
Affected
up to 2.18.0
What to do
Affects up to 2.18.0. Update GutenBee – Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 30, 2025FancyTabs: Stored Cross-Site ScriptingCVE-2025-8560 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FancyTabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FancyTabs
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update FancyTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 30, 2025The Pack Elementor addon: Stored Cross-Site ScriptingCVE-2025-8214 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typing Letter widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Pack Elementor addon
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update The Pack Elementor addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 30, 2025LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2025-6941 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepoint_resources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.1.94
What to do
Affects up to 5.1.94. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2025-6815 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘service[name]’ parameter in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.1.94
What to do
Affects up to 5.1.94. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 30, 2025Survey Anyplace: Stored Cross-Site ScriptingCVE-2025-10196 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplace_embed' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Survey Anyplace
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Survey Anyplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Sep 30, 2025Big Post Shipping for WooCommerce: Stored Cross-Site ScriptingCVE-2025-10191 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Big Post Shipping for WooCommerce
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Big Post Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025BP Direct Menus: Stored Cross-Site ScriptingCVE-2025-10189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdm_login' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BP Direct Menus
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update BP Direct Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025dbview: Stored Cross-Site ScriptingCVE-2025-10182 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
dbview
Affected
up to 0.5.5
What to do
Affects up to 0.5.5. Update dbview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025My AskAI: Stored Cross-Site ScriptingCVE-2025-10179 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My AskAI
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update My AskAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025Any News Ticker: Stored Cross-Site ScriptingCVE-2025-10168 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shortcode in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Any News Ticker
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Any News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 30, 2025All Social Share Options: Stored Cross-Site ScriptingCVE-2025-10131 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All Social Share Options
Affected
up to 1.0
What to do
Affects up to 1.0. Update All Social Share Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025Layers: Stored Cross-Site ScriptingCVE-2025-10130 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Layers
Affected
up to 0.5
What to do
Affects up to 0.5. Update Layers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.