Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

525new WordPress flaws this week

391,883entries in the database

9,083 results · page 96 of 182

Jan 31, 2025Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Stored Cross-Site ScriptingCVE-2024-12037 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bf_new_submission_link' shortcode in all versions up to, and including, 2.8.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Affected
up to 2.8.13
What to do
Affects up to 2.8.13. Update Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2025WP Sessions Time Monitoring Full Automatic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Reflected XSS.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.1.
Product
WP Sessions Time Monitoring Full Automatic
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025Barcode Generator for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2025-24597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Retrieve Embedded Sensitive Data.This issue affects Barcode Generator for WooCommerce: from n/a through <= 2.0.2.
Product
Barcode Generator for WooCommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Barcode Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025Cleanup – Directory Listing & Classifieds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeglow Cleanup – Directory Listing & Classifieds WordPress Plugin cleanup-light allows Reflected XSS.This issue affects Cleanup – Directory Listing & Classifieds WordPress Plugin: from n/a through <= 1.0.4.
Product
Cleanup – Directory Listing & Classifieds
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Cleanup – Directory Listing & Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025EMI Calculator: Missing AuthorizationCVE-2025-22265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in mgplugin EMI Calculator emi-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EMI Calculator: from n/a through <= 1.1.
Product
EMI Calculator
Affected
up to 1.1
What to do
Affects up to 1.1. Update EMI Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025WP DataTable: Stored Cross-Site ScriptingCVE-2024-13566 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 0.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP DataTable
Affected
up to 0.2.6
What to do
Affects up to 0.2.6. Update WP DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Stored Cross-Site ScriptingCVE-2024-13157 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Podcast RSS Feed in all versions up to, and including, 5.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Affected
up to 5.9.3
What to do
Affects up to 5.9.3. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Link Fixer: Stored Cross-Site ScriptingCVE-2025-0809 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Link Fixer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via broken links in all versions up to, and including, 3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Link Fixer
Affected
up to 3.4
What to do
Affects up to 3.4. Update Link Fixer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 31, 2025Shared Files – Frontend File Upload Form & Secure File Sharing: Stored Cross-Site ScriptingCVE-2024-13504 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dfxp File uploads in all versions up to, and including, 1.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the dfxp file. This issue affects only Apache-based environments, where dfxp files are handled by default.
Product
Shared Files – Frontend File Upload Form & Secure File Sharing
Affected
up to 1.7.42
What to do
Affects up to 1.7.42. Update Shared Files – Frontend File Upload Form & Secure File Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025HT Event – WordPress Event Manager Plugin for Elementor: Sensitive Information ExposureCVE-2024-13216 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HT Event – WordPress Event Manager Plugin for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.7 via the 'render' function in /includes/widgets/htevent_sponsor.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
Product
HT Event – WordPress Event Manager Plugin for Elementor
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update HT Event – WordPress Event Manager Plugin for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2025Contact Form and Calls To Action by vcita: Stored Cross-Site ScriptingCVE-2024-11886 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler ' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form and Calls To Action by vcita
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Contact Form and Calls To Action by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Ticketmeo – Sell Tickets – Event Ticketing: Stored Cross-Site ScriptingCVE-2025-0507 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ticketmeo – Sell Tickets – Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ticketmeo – Sell Tickets – Event Ticketing
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Ticketmeo – Sell Tickets – Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2024-10867 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 30, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Reflected Cross-Site ScriptingCVE-2025-0470 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.38.2
What to do
Affects up to 1.38.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025SeatReg: Stored Cross-Site ScriptingCVE-2024-13463 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SeatReg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'seatreg' shortcode in all versions up to, and including, 1.56.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SeatReg
Affected
up to 1.56.0
What to do
Affects up to 1.56.0. Update SeatReg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025Gosign – Posts Slider Block: Stored Cross-Site ScriptingCVE-2024-13399 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gosign – Posts Slider Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posts-slider-block' block in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gosign – Posts Slider Block
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Gosign – Posts Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 30, 2025WPRadio – WordPress Radio Streaming: Stored Cross-Site ScriptingCVE-2024-13397 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPRadio – WordPress Radio Streaming Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpradio_player' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPRadio – WordPress Radio Streaming
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WPRadio – WordPress Radio Streaming to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Frictionless: Stored Cross-Site ScriptingCVE-2024-13396 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionless_form' shortcode[s] in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Frictionless
Affected
up to 0.0.23
What to do
Affects up to 0.0.23. Update Frictionless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 30, 2025Elementor Website Builder Pro: Sensitive Information ExposureCVE-2024-8494 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'elementor-template' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of Private, Pending, and Draft Templates. The vulnerability was partially patched in version 3.24.4.
Product
Elementor Website Builder Pro
Affected
up to 3.25.10
What to do
Affects up to 3.25.10. Update Elementor Website Builder Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record elementor.com wordfence.com
Jan 30, 2025zStore Manager Basic: Unauthorized loss of dataCVE-2024-13715 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstore_clear_cache() function in all versions up to, and including, 3.311. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's cache.
Product
zStore Manager Basic
Affected
up to 3.311
What to do
Affects up to 3.311. Update zStore Manager Basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025Embed Swagger UI: Stored Cross-Site ScriptingCVE-2024-13700 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Embed Swagger UI
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Embed Swagger UI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 30, 2025Music Sheet Viewer: Stored Cross-Site ScriptingCVE-2024-13670 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Music Sheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pn_msv' shortcode in all versions up to, and including, 4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Music Sheet Viewer
Affected
up to 4.1
What to do
Affects up to 4.1. Update Music Sheet Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025WP Post List Table: Stored Cross-Site ScriptingCVE-2024-13664 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Post List Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpb_post_list_table' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Post List Table
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WP Post List Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025Table Editor: Stored Cross-Site ScriptingCVE-2024-13661 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Table Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wptableeditor_vtabs' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Table Editor
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Table Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025All Bootstrap Blocks: Stored Cross-Site ScriptingCVE-2024-13549 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All Bootstrap Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Accordion" widget in all versions up to, and including, 1.3.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All Bootstrap Blocks
Affected
up to 1.3.26
What to do
Affects up to 1.3.26. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025WE – Testimonial Slider: Stored Cross-Site ScriptingCVE-2024-13460 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WE – Testimonial Slider
Affected
up to 1.5
What to do
Affects up to 1.5. Update WE – Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 30, 2025Kona Gallery Block: Stored Cross-Site ScriptingCVE-2024-13400 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kona Gallery Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Kona: Instagram for Gutenberg" Block, specifically in the "align" attribute, in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Kona Gallery Block
Affected
up to 1.7
What to do
Affects up to 1.7. Update Kona Gallery Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 30, 2025Stockdio Historical Chart: Stored Cross-Site ScriptingCVE-2024-13349 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Stockdio Historical Chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stockdio-historical-chart' shortcode in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Stockdio Historical Chart
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update Stockdio Historical Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025HTML5 chat: Stored Cross-Site ScriptingCVE-2024-12451 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HTML5 chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'HTML5CHAT' shortcode in all versions up to, and including, 1.07 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HTML5 chat
Affected
up to 1.07
What to do
Affects up to 1.07. Update HTML5 chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025WP Dispensary: Stored Cross-Site ScriptingCVE-2024-12444 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Dispensary plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpd_menu' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Dispensary
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update WP Dispensary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 30, 2025Ai Image Alt Text Generator for WP: Reflected Cross-Site ScriptingCVE-2024-12177 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Ai Image Alt Text Generator for WP
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Remote Code ExecutionCVE-2024-11600 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.6.0 via the 'write_config' function. This is due to a lack of sanitization on an imported JSON file. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Unauthorized loss of dataCVE-2024-11583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_zipped_font' function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete icon fonts that were previously uploaded.
Product
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Storely: Stored Cross-Site ScriptingCVE-2024-10847 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Storely theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Storely
Affected
up to 18
What to do
Affects up to 18. Update Storely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 30, 2025Automatically Hierarchic Categories in Menu: Stored Cross-Site ScriptingCVE-2024-13466 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Automatically Hierarchic Categories in Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autocategorymenu' shortcode in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Automatically Hierarchic Categories in Menu
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Alex Reservations: Smart Restaurant Booking: Stored Cross-Site ScriptingCVE-2024-13380 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rr_form' shortcode in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Alex Reservations: Smart Restaurant Booking
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Alex Reservations: Smart Restaurant Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Clinked Client Portal: Stored Cross-Site ScriptingCVE-2024-12524 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Clinked Client Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'clinked-login-button' shortcode in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Clinked Client Portal
Affected
up to 1.9
What to do
Affects up to 1.9. Update Clinked Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Responsive Blocks – WordPress Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2024-13732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘section_tag’ parameter in all versions up to, and including, 1.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Blocks – WordPress Gutenberg Blocks
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update Responsive Blocks – WordPress Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features): Insecure Direct Object ReferenceCVE-2024-13694 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.7 via the download_pdf_file() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to extract data from wishlists that they should not have access to.
Product
WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features)
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2024-13470 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms – The Contact Form Builder That Grows With You
Affected
up to 3.8.24
What to do
Affects up to 3.8.24. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Stratum – Elementor Widgets: Stored Cross-Site ScriptingCVE-2024-13642 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hotspot widget in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Stratum – Elementor Widgets
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Stratum – Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2025EthereumICO: Stored Cross-Site ScriptingCVE-2024-12921 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EthereumICO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ethereum-ico shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
EthereumICO
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update EthereumICO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 29, 2025Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules: Stored Cross-Site ScriptingCVE-2025-0353 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 29, 2025Target Video Easy Publish: Stored Cross-Site ScriptingCVE-2024-13561 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's brid_override_yt shortcode in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Target Video Easy Publish
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 29, 2025Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later: Stored Cross-Site ScriptingCVE-2024-13696 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later
Affected
up to 1.2.25
What to do
Affects up to 1.2.25. Update Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: Stored Cross-Site ScriptingCVE-2025-0804 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via link titles in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 28, 2025Philantro – Donations and Donor Management: Stored Cross-Site ScriptingCVE-2024-13527 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Philantro – Donations and Donor Management
Affected
up to 5.3
What to do
Affects up to 5.3. Update Philantro – Donations and Donor Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 28, 2025ElementsKit Pro: DOM-Based Stored Cross-Site ScriptingCVE-2025-0321 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ElementsKit Pro
Affected
up to 3.7.8
What to do
Affects up to 3.7.8. Update ElementsKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmet.com wpmet.com
Jan 28, 2025The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13CVE-2024-13509 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability is partially fixed in 1.10.13 and completely fixed in 1.10.14.
Affected
up to 1.10.13
Fixed in
1.10.13
What to do
Update the plugin to 1.10.13 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2025WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24708 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-dynamics-crm allows Reflected XSS.This issue affects WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.6.
Product
WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.