Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

477new WordPress flaws this week

390,525entries in the database

55 results · page 1 of 2

Oct 24, 2026Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-112866 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
Product
Product Filter by WBW
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.CVE-2026-95601 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2026Product Filter for WooCommerce by WBW: Reflected Cross-Site ScriptingCVE-2026-7804 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present.
Product
Product Filter for WooCommerce by WBW
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update Product Filter for WooCommerce by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2026Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39494 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.
Product
Product Filter by WBW
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 13, 2026Product Filter for WooCommerce by WBW: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-3830 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Product
Product Filter for WooCommerce by WBW
Fixed in
3.1.3
What to do
Update Product Filter for WooCommerce by WBW to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Mar 26, 2026BWL Advanced FAQ Manager Lite: Stored Cross-Site ScriptingCVE-2026-4075 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'baf_sbox' shortcode in all versions up to and including 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'sbox_id', 'sbox_class', 'placeholder', 'highlight_color', 'highlight_bg', and 'cont_ext_class'. These attributes are directly interpolated into HTML element attributes without any esc_attr() escaping in the baf_sbox() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BWL Advanced FAQ Manager Lite
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update BWL Advanced FAQ Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 24, 2026Product Filter for WooCommerce by WBW: Unauthorized data lossCVE-2026-3138 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via `wp_ajax_nopriv_` hooks without verifying user capabilities, combined with the base controller's `__call()` magic method forwarding undefined method calls to the model layer, and the `havePermissions()` method defaulting to `true` when no permissions are explicitly defined. This makes it possible for unauthenticated attackers to truncate the plugin's `wp_wpf_filters` database table via a crafted AJAX request with `action=delete`, permanently destroying all filter configurations.
Product
Product Filter for WooCommerce by WBW
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Product Filter for WooCommerce by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026WBW Currency Switcher for WooCommerce: Missing AuthorizationCVE-2026-32410 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WBW Plugins WBW Currency Switcher for WooCommerce woo-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WBW Currency Switcher for WooCommerce: from n/a through <= 2.2.5.
Product
WBW Currency Switcher for WooCommerce
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WBW Currency Switcher for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026JobWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69318 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak JobWP jobwp allows Stored XSS.This issue affects JobWP: from n/a through <= 2.4.5.
Product
JobWP
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025BWL Knowledge Base Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68992 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allows Stored XSS.This issue affects BWL Knowledge Base Manager: from n/a through <= 1.6.3.
Product
BWL Knowledge Base Manager
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update BWL Knowledge Base Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025BWL Pro Voting Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows DOM-Based XSS.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.
Product
BWL Pro Voting Manager
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update BWL Pro Voting Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025BWL Pro Voting Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68990 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows Blind SQL Injection.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.
Product
BWL Pro Voting Manager
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update BWL Pro Voting Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2025Product Filter by WBW: SQL InjectionCVE-2025-8416 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Product Filter by WBW
Affected
up to 2.9.7
What to do
Affects up to 2.9.7. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2025Product Filter by WBW: Unauthorized modification of dataCVE-2025-11269 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'approveNotice' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to update the plugin's settings.
Product
Product Filter by WBW
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 22, 2025JobWP: Cross-Site Request Forgery (CSRF)CVE-2025-57895 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.4.3.
Product
JobWP
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025JobWP: Cross-Site Request Forgery (CSRF)CVE-2025-49975 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.4.0.
Product
JobWP
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025WBW Product Table PRO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31059 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in woobewoo WBW Product Table PRO woo-producttables-pro allows SQL Injection.This issue affects WBW Product Table PRO: from n/a through <= 2.2.6.
Product
WBW Product Table PRO
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update WBW Product Table PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 18, 2025JobWP – Job Board, Job Listing, Career Page and Recruitment: SQL InjectionCVE-2025-2010 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
JobWP – Job Board, Job Listing, Career Page and Recruitment
Affected
up to 2.3.9
What to do
Affects up to 2.3.9. Update JobWP – Job Board, Job Listing, Career Page and Recruitment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2025JobWP: Cross-Site Request Forgery (CSRF)CVE-2025-32265 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.3.9.
Product
JobWP
Affected
up to 2.3.9
What to do
Affects up to 2.3.9. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025BWD Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32189 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer BWD Elementor Addons bwd-elementor-addons allows DOM-Based XSS.This issue affects BWD Elementor Addons: from n/a through <= 4.4.2.
Product
BWD Elementor Addons
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update BWD Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Product Filter by WBW: Time-based SQL InjectionCVE-2025-2317 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Filter by WBW plugin for WordPress is vulnerable to time-based SQL Injection via the filtersDataBackend parameter in all versions up to, and including, 2.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Product Filter by WBW
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2025Product Table by WBW: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31086 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WBW Plugins Product Table by WBW woo-product-tables allows Reflected XSS.This issue affects Product Table by WBW: from n/a through <= 2.1.4.
Product
Product Table by WBW
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025BWL Advanced FAQ Manager: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13801 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'baf_set_notice_status' AJAX action in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to '1' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Product
BWL Advanced FAQ Manager
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update BWL Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 3, 2025Cobwebo URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in editionskezzal Cobwebo URL Plugin cobwebo-url allows Reflected XSS.This issue affects Cobwebo URL Plugin: from n/a through <= 1.0.
Product
Cobwebo URL
Affected
up to 1.0
What to do
Affects up to 1.0. Update Cobwebo URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025Product Table by WBW: SQL InjectionCVE-2024-13234 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Product Table by WBW
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025BWD Elementor Addons: Sensitive Information ExposureCVE-2024-12532 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
BWD Elementor Addons
Affected
up to 4.3.18
What to do
Affects up to 4.3.18. Update BWD Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2024Product Filter by WBW: Missing AuthorizationCVE-2023-50877 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in woobewoo Product Filter by WBW allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Filter by WBW: from n/a through 2.5.0.
Product
Product Filter by WBW
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statementCVE-2024-9186 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Product
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
Fixed in
3.3.0
What to do
Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to 3.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2024Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49691 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW woo-product-filter allows SQL Injection.This issue affects Product Filter by WBW: from n/a through <= 2.7.0.
Product
Product Filter by WBW
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024WBW Product Table PRO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43918 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WBW Product Table PRO allows SQL Injection.This issue affects WBW Product Table PRO: from n/a through 1.9.4.
Product
WBW Product Table PRO
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update WBW Product Table PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 9, 2024Product Table by WBW: Remote Code ExecutionCVE-2024-6365 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' function. This is due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file. This makes it possible for unauthenticated attackers to execute code on the server.
Product
Product Table by WBW
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Subway – Private Site Option: Sensitive Information ExposureCVE-2024-1678 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's private site feature and view restricted page and post content.
Product
Subway – Private Site Option
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Subway – Private Site Option to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 15, 2024BWL Advanced FAQ Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32136 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xenioushk BWL Advanced FAQ Manager.This issue affects BWL Advanced FAQ Manager: from n/a through 2.0.3.
Product
BWL Advanced FAQ Manager
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update BWL Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29810 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29809 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29808 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 15, 2024Product Table by WBW: Cross Site Request Forgery (CSRF)CVE-2023-51512 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.This issue affects Product Table by WBW: from n/a through 1.8.6.
Product
Product Table by WBW
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WordPress Job Board and Recruitment Plugin – JobWP: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48288 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.1.
Product
WordPress Job Board and Recruitment Plugin – JobWP
Affected
up to 2.1
What to do
Affects up to 2.1. Update WordPress Job Board and Recruitment Plugin – JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023WordPress Job Board and Recruitment Plugin – JobWP: Unrestricted Upload of File with Dangerous TypeCVE-2023-29384 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.
Product
WordPress Job Board and Recruitment Plugin – JobWP
Affected
up to 2.0
What to do
Affects up to 2.0. Update WordPress Job Board and Recruitment Plugin – JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Albert Peschar WebwinkelKeur plugin <= 3.24 versions.CVE-2023-36691 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Albert Peschar WebwinkelKeur plugin <= 3.24 versions.
Fixed in
3.25
What to do
Update the plugin to 3.25 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 7, 2023The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data.CVE-2021-46889 · WordPress plugins & themes · reported by MITREMedium 6.1
The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.
Product
10Web Photo Gallery
Affected
up to 1.5.69
What to do
Affects up to 1.5.69. Update 10Web Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Nov 29, 2022The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data.CVE-2021-31693 · WordPress plugins & themes · reported by MITREMedium 6.1
The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware information, previously connected to this CVE ID because of a typo, is at CVE-2022-31693.
Product
10Web Photo Gallery
Affected
up to 1.5.68
What to do
Affects up to 1.5.68. Update 10Web Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 16, 2022WBW Currency Switcher for WooCommerce: Does not sanitise and escape some of its settingsCVE-2022-2575 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WBW Currency Switcher for WooCommerce
Fixed in
1.6.6
What to do
Update WBW Currency Switcher for WooCommerce to 1.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Product
Photo Gallery by 10Web
Fixed in
1.6.0
What to do
Update Photo Gallery by 10Web to 1.6.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcCVE-2021-25041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action
Product
Photo Gallery by 10Web
Fixed in
1.5.68
What to do
Update Photo Gallery by 10Web to 1.5.68 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 26, 2019The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, andCVE-2015-9537 · WordPress plugins & themes · reported by MITREMedium 5.4
The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.
Product
NextGEN Gallery
Fixed in
2.1.10
What to do
Update NextGEN Gallery to 2.1.10 or newer.
Full record and what to do →NVD record cybersecurityworks.com github.com
Aug 21, 2019The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18516 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
bws-linkedin
Fixed in
1.0.5
What to do
Update bws-linkedin to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.CVE-2017-18558 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
Product
bws-testimonials
Fixed in
0.1.9
What to do
Update bws-testimonials to 0.1.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.CVE-2017-18557 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
Product
bws-google-maps
Fixed in
1.3.6
What to do
Update bws-google-maps to 1.3.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 21, 2019The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.CVE-2017-18556 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
Product
bws-google-analytics
Fixed in
1.7.1
What to do
Update bws-google-analytics to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.