Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Jan 22, 2026Payment Gateway Authorize.Net CIM for WooCommerce: Missing AuthorizationCVE-2025-68013 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.
- Product
- Payment Gateway Authorize.Net CIM for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Payment Gateway Authorize.Net CIM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2025Contact Forms by Cimatti: Cross-Site Request Forgery (CSRF)CVE-2025-49069 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in cimatti Contact Forms by Cimatti contact-forms allows Cross Site Request Forgery.This issue affects Contact Forms by Cimatti: from n/a through <= 1.9.8.
- Product
- Contact Forms by Cimatti
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WordPress Contact Forms by Cimatti: Unauthorized access of dataCVE-2024-12184 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the accua_forms_download_submitted_file() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to download other user submitted forms.
- Product
- WordPress Contact Forms by Cimatti
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update WordPress Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024Contact Forms by Cimatti: Missing AuthorizationCVE-2023-35051 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7.
- Product
- Contact Forms by Cimatti
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2024WordPress Contact Forms by Cimatti: Cross-Site Request ForgeryCVE-2024-10521 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to delete forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WordPress Contact Forms by Cimatti
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update WordPress Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 31, 2024Contact Forms by Cimatti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30549 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cimatti Contact Forms by Cimatti contact-forms.This issue affects Contact Forms by Cimatti: from n/a through <= 1.8.0.
- Product
- Contact Forms by Cimatti
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 19, 2024Contact Forms by Cimatti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29117 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Stored XSS.This issue affects Contact Forms by Cimatti: from n/a through 1.7.0.
- Product
- Contact Forms by Cimatti
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.CVE-2023-47230 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 12, 2023WordPress Contact Forms by Cimatti: Cross-Site Request ForgeryCVE-2023-2563 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.7. This is due to missing or incorrect nonce validation on the function _accua_forms_form_edit_action. This makes it possible for unauthenticated attackers to delete forms created with this plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WordPress Contact Forms by Cimatti
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update WordPress Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2022Cimy Header Image Rotator: Does not have CSRF check in placeCVE-2022-1885 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Cimy Header Image Rotator
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update Cimy Header Image Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021WordPress Contact Forms by Cimatti: Does not sanitise and escape the Form Title before outputting it in some admin pagesCVE-2021-24744 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- WordPress Contact Forms by Cimatti
- Fixed in
- 1.4.12
- What to do
- Update WordPress Contact Forms by Cimatti to 1.4.12 or newer.
Sep 20, 2019The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.CVE-2016-10998 · WordPress plugins & themes · reported by MITREMedium 6.1
The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.
- Product
- ocim-mp3
- Affected
- up to 2016-03-07
- What to do
- Affects up to 2016-03-07. Update ocim-mp3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Aug 7, 2016WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass anCVE-2016-4029 · WordPress plugins & themes · reported by MITREHigh 8.6
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
- Fixed in
- 4.5
- What to do
- Update the plugin to 4.5 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgdebian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.