Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Oct 28, 2026GeoDirectory: Does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listingCVE-2026-113487 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
- Product
- GeoDirectory
- Fixed in
- 2.8.196
- What to do
- Update GeoDirectory to 2.8.196 or newer.
Dec 18, 2025Anchor smooth scroll: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60072 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Anchor smooth scroll anchor-smooth-scroll allows PHP Local File Inclusion.This issue affects Anchor smooth scroll: from n/a through <= 1.0.2.
- Product
- Anchor smooth scroll
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Anchor smooth scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2024WP Simple Anchors Links: Stored Cross-Site ScriptingCVE-2024-9446 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Simple Anchors Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpanchor shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Simple Anchors Links
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Simple Anchors Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 22, 2024Anchor Episodes Index (Spotify for Podcasters): Stored Cross-Site ScriptingCVE-2024-10189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Anchor Episodes Index (Spotify for Podcasters) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's anchor_episodes shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Anchor Episodes Index (Spotify for Podcasters)
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update Anchor Episodes Index (Spotify for Podcasters) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 31, 2024Better Anchor Links: Cross-Site Request Forgery (CSRF)CVE-2024-22287 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links: from n/a through 1.7.5.
- Product
- Better Anchor Links
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Better Anchor Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 2, 2023jesweb.Dev Anchor Episodes Index: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-44145 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in jesweb.Dev Anchor Episodes Index (Spotify for Podcasters) plugin <= 2.1.7 versions.
- Product
- jesweb.Dev Anchor Episodes Index
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update jesweb.Dev Anchor Episodes Index to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 23, 2019The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier.CVE-2015-9503 · WordPress plugins & themes · reported by MITREMedium 6.1
The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier.
- Product
- Modern
- Fixed in
- 1.4.2
- What to do
- Update Modern to 1.4.2 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Oct 23, 2019The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier.CVE-2015-9502 · WordPress plugins & themes · reported by MITREMedium 6.1
The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier.
- Product
- Auberge
- Fixed in
- 1.4.5
- What to do
- Update Auberge to 1.4.5 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Oct 22, 2019The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.CVE-2015-9500 · WordPress plugins & themes · reported by MITREMedium 6.1
The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
- Affected
- 1.3.3 to 1.3.3
- What to do
- Affects 1.3.3 to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 22, 2019The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.CVE-2015-9495 · WordPress plugins & themes · reported by MITREMedium 6.1
The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.
- Product
- syndication-links
- Fixed in
- 1.0.3
- What to do
- Update syndication-links to 1.0.3 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 22, 2019The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.CVE-2015-9494 · WordPress plugins & themes · reported by MITREMedium 6.1
The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.
- Product
- indieweb-post-kinds
- Fixed in
- 1.3.1.1
- What to do
- Update indieweb-post-kinds to 1.3.1.1 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.