Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Aug 6, 2026Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.CVE-2026-65572 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.CVE-2026-39433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.
- What to do
- Update the plugin to the newest version.
Mar 7, 2026Paid Videochat Turnkey Site – HTML5 PPV Live Webcams: Privilege EscalationCVE-2025-8899 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful.
- Product
- Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
- Affected
- up to 7.3.20
- What to do
- Affects up to 7.3.20. Update Paid Videochat Turnkey Site – HTML5 PPV Live Webcams to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 5, 2026M.Williamson: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28055 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX M.Williamson williamson allows PHP Local File Inclusion.This issue affects M.Williamson: from n/a through <= 1.2.11.
- Product
- M.Williamson
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update M.Williamson to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026JAMstack Deployments: Missing AuthorizationCVE-2026-25409 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JAMstack Deployments: from n/a through <= 1.1.1.
- Product
- JAMstack Deployments
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update JAMstack Deployments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2025Devs CRM – Manage tasks, attendance and teams all together: Unauthorized modification of dataCVE-2025-13093 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update leads tags.
- Product
- Devs CRM – Manage tasks, attendance and teams all together
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Devs CRM – Manage tasks, attendance and teams all together to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 13, 2025Devs CRM – Manage tasks, attendance and teams all together: Unauthorized access of dataCVE-2025-13092 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API Endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to retrieve private user data, including password hashes.
- Product
- Devs CRM – Manage tasks, attendance and teams all together
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Devs CRM – Manage tasks, attendance and teams all together to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 24, 2025eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams: Exposure of sensitive informationCVE-2025-11760 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the sdk_secret value, which should remain server-side, compromising the security of the Zoom integration and allowing attackers to generate valid JWT signatures for unauthorized meeting access.
- Product
- eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 22, 2025Social Streams: Privilege escalationCVE-2025-7722 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their user meta information in the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their user type to that of an administrator.
- Product
- Social Streams
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Social Streams to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39402 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39401 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39395 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39392 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39406 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPAMS apartment-management allows PHP Local File Inclusion.This issue affects WPAMS: from n/a through <= 44.0.
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Incorrect Privilege AssignmentCVE-2025-39405 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in mojoomla WPAMS apartment-management allows Privilege Escalation.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39403 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Dreamstime Stock Photos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25090 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dreamstime Dreamstime Stock Photos dreamstime-stock-photos allows Reflected XSS.This issue affects Dreamstime Stock Photos: from n/a through <= 4.1.
- Product
- Dreamstime Stock Photos
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Dreamstime Stock Photos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024AgendaPress – Easily Publish Meeting Agendas and Programs on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51807 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Black and White AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress agendapress allows Stored XSS.This issue affects AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress: from n/a through <= 1.0.8.
- Product
- AgendaPress – Easily Publish Meeting Agendas and Programs on
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update AgendaPress – Easily Publish Meeting Agendas and Programs on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2023URL Params: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0274 · WordPress plugins & themes · reported by WPScanMedium 5.4
The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- URL Params
- Fixed in
- 2.5
- What to do
- Update URL Params to 2.5 or newer.
Mar 27, 2023WP Shamsi: Has CSRF and broken access control vulnerabilitiesCVE-2023-0335 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.
- Product
- WP Shamsi
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update WP Shamsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2022WP Shamsi: Authorization bypassCVE-2022-4555 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.
- Product
- WP Shamsi
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update WP Shamsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2022Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.CVE-2022-38058 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 27, 2017Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14847 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers CVE-2011-5194 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter, a different vulnerability than CVE-2011-5193.
- Product
- Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search
- Fixed in
- 1.4.2.3
- What to do
- Update Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search to 1.4.2.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.orgplugins.trac.wordpress.org
Sep 23, 2012Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enablCVE-2011-5193 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than CVE-2011-5194.
- Product
- Whois Search
- What to do
- Update Whois Search to the newest version.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.