Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
102 results · page 1 of 3
Oct 6, 2026Autoship Cloud for WooCommerce Subscription Products: Missing AuthorizationCVE-2026-39762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.
- Product
- Autoship Cloud for WooCommerce Subscription Products
- Affected
- up to 2.17.1
- What to do
- Affects up to 2.17.1. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.CVE-2026-39749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versionsCVE-2026-93031 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocumentation.wpcloudplugins.comwpcloudplugins.gitbook.io
Sep 12, 2026Yogeta WP Cloud: Does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization checkCVE-2026-80494 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.
- Product
- Yogeta WP Cloud
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Yogeta WP Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, inCVE-2026-85116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
- Fixed in
- 1.42.3
- What to do
- Update the plugin to 1.42.3 or newer.
Sep 10, 2026Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66674 · WordPress plugins & themes · reported by PatchstackMedium 5.6
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.
- Affected
- up to 1.42.1
- What to do
- Affects up to 1.42.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66632 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.
- Affected
- up to 1.42.1
- What to do
- Affects up to 1.42.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 15, 2026Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!: Remote Code ExecutionCVE-2026-18438 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. A GIF+PHP polyglot file passes wp_check_filetype_and_ext validation as image/gif via the Content-Disposition filename, while the actual destination path is written with a .php extension derived from the URL path, bypassing the unfiltered_upload capability gate entirely. The affected endpoints are reachable at this privilege level because Templately's entire REST API — including the cloud import endpoints used in this attack (/templately/v1/clouds/upload and /templately/v1/insert) — is authorized only by a current_user_can('delete_posts') check, with no administrator or manage_options capabili
- Product
- Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 7, 2026Simple CAPTCHA with Cloudflare Turnstile: Does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integrationCVE-2026-15239 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.
- Product
- Simple CAPTCHA with Cloudflare Turnstile
- Fixed in
- 1.42.0
- What to do
- Update Simple CAPTCHA with Cloudflare Turnstile to 1.42.0 or newer.
Jul 17, 2026pCloud WP Backup: Sensitive Information ExposureCVE-2026-14503 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_process_request_inner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a full-site backup archive written to a publicly accessible directory, exposing wp-config.php database credentials, WordPress secret salts, and the complete PHP source tree. The resulting archive is deposited in the plugin's unprotected tmp/ directory at a predictable URL, making the extracted data accessible to unauthenticated visitors once the backup is triggered.
- Product
- pCloud WP Backup
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update pCloud WP Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2026tagDiv Cloud Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57733 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through <= 3.9.4.
- Product
- tagDiv Cloud Library
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update tagDiv Cloud Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2026Sendcloud Shipping: Missing AuthorizationCVE-2026-57760 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29.
- Product
- Sendcloud Shipping
- Affected
- up to 1.0.29
- What to do
- Affects up to 1.0.29. Update Sendcloud Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.CVE-2026-57757 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 18, 2026Offload, AI & Optimize with Cloudflare Images: Remote Code ExecutionCVE-2026-9860 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cf_images_do_setup AJAX handler, which requires only the upload_files capability (Author+) rather than manage_options before writing to wp-config.php, combined with the absence of single-quote escaping — sanitize_text_field() does not strip single quotes, and filter_input(INPUT_POST) bypasses wp_magic_quotes() slashing — allowing a single quote in the account-id or api-key parameter to break out of the single-quoted PHP string literal in the write_config() define() statement. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. This is possible because the 'cf-images-nonce' nonce required by the AJAX handler is exposed to all Author-level and above users on wp-admin/upload.php via the CFImages JavaScript object, meaning any upload-capable user can satisfy the nonce check and reach the vulnerable wp-config.php write path.
- Product
- Offload, AI & Optimize with Cloudflare Images
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update Offload, AI & Optimize with Cloudflare Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.CVE-2026-42411 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.CVE-2026-40799 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.
- Affected
- up to 1.38.0
- What to do
- Affects up to 1.38.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026Autoship Cloud for WooCommerce Subscription Products: Missing AuthorizationCVE-2026-24527 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.14.0.
- Product
- Autoship Cloud for WooCommerce Subscription Products
- Affected
- up to 2.14.0
- What to do
- Affects up to 2.14.0. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Mailercloud – Integrate webforms and synchronize website contacts: Missing AuthorizationCVE-2026-39713 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.
- Product
- Mailercloud – Integrate webforms and synchronize website contacts
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Mailercloud – Integrate webforms and synchronize website contacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026CloudMe: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22433 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CloudMe cloudme allows PHP Local File Inclusion.This issue affects CloudMe: from n/a through <= 1.2.2.
- Product
- CloudMe
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update CloudMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Cool Tag Cloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69011 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Cool Tag Cloud cool-tag-cloud allows Stored XSS.This issue affects Cool Tag Cloud: from n/a through <= 2.29.
- Product
- Cool Tag Cloud
- Affected
- up to 2.29
- What to do
- Affects up to 2.29. Update Cool Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Cloudinary: Missing AuthorizationCVE-2026-24560 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cloudinary Cloudinary cloudinary-image-management-and-manipulation-in-the-cloud-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cloudinary: from n/a through <= 3.3.2.
- Product
- Cloudinary
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Cloudinary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026TaxCloud for WooCommerce: Missing AuthorizationCVE-2025-67958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TaxCloud for WooCommerce: from n/a through <= 8.3.8.
- Product
- TaxCloud for WooCommerce
- Affected
- up to 8.3.8
- What to do
- Affects up to 8.3.8. Update TaxCloud for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025SensitiveTagCloud: Cross-Site Request Forgery (CSRF)CVE-2025-49344 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in reneade SensitiveTagCloud sensitive-tag-cloud allows Stored XSS.This issue affects SensitiveTagCloud: from n/a through <= 1.4.1.
- Product
- SensitiveTagCloud
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update SensitiveTagCloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Offload, AI & Optimize with Cloudflare Images: Missing AuthorizationCVE-2025-66104 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anton Vanyukov Offload, AI & Optimize with Cloudflare Images cf-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Offload, AI & Optimize with Cloudflare Images: from n/a through <= 1.9.5.
- Product
- Offload, AI & Optimize with Cloudflare Images
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update Offload, AI & Optimize with Cloudflare Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2025Cool Tag Cloud: Stored Cross-Site ScriptingCVE-2025-13614 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Cool Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cool_tag_cloud' shortcode in all versions up to, and including, 2.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Cool Tag Cloud
- Affected
- up to 2.29
- What to do
- Affects up to 2.29. Update Cool Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 2, 2025Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Unauthorized accessCVE-2025-10304 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the process_status_unlink() function in all versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to delete the back-up progress files and cause a back-up to fail while it is in progress.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 6, 2025tagDiv Cloud Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62032 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through < 3.9.2.
- Product
- tagDiv Cloud Library
- What to do
- Update tagDiv Cloud Library to the newest version.
Oct 26, 2025CloudSearch: Cross-Site Request Forgery (CSRF)CVE-2025-62962 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio CloudSearch cloud-search allows Stored XSS.This issue affects CloudSearch: from n/a through <= 3.0.0.
- Product
- CloudSearch
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update CloudSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2025Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Unauthorized access of dataCVE-2025-11380 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location.
- Product
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 3, 2025WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder: Missing authorizationCVE-2025-9029 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorization via the wdkit_handle_review_submission function in versions less than, or equal to, 1.2.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to submit feedback data to external services.
- Product
- WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
- What to do
- Update WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 26, 2025W3SCloud Contact Form 7 to Zoho CRM: Cross-Site Request Forgery (CSRF)CVE-2025-60169 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through <= 3.2.
- Product
- W3SCloud Contact Form 7 to Zoho CRM
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update W3SCloud Contact Form 7 to Zoho CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2025Cloud SAML SSO: Identity Provider DeletionCVE-2025-7045 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the delete_config action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. This makes it possible for unauthenticated attackers to delete any configured IdP, breaking the SSO authentication flow and causing a denial-of-service.
- Product
- Cloud SAML SSO
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Cloud SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2025Cloud SAML SSO: Unauthorized modification of dataCVE-2025-7040 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'set_organization_settings' action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters for organization settings and passes them directly to update_option() without any check of the user’s capabilities or a CSRF nonce. This makes it possible for unauthenticated attackers to change critical configuration (including toggling signing and encryption), potentially breaking the SSO flow and causing a denial-of-service.
- Product
- Cloud SAML SSO
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Cloud SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2025Search Cloud One: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58883 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Harris Search Cloud One search-cloud-one allows Stored XSS.This issue affects Search Cloud One: from n/a through <= 2.2.5.
- Product
- Search Cloud One
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update Search Cloud One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Donation Forms WP by Givecloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58842 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in givecloud Donation Forms WP by Givecloud donation-forms-by-givecloud allows Stored XSS.This issue affects Donation Forms WP by Givecloud: from n/a through <= 1.0.9.
- Product
- Donation Forms WP by Givecloud
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Donation Forms WP by Givecloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2025Cloudflare Image Resizing: Remote Code ExecutionCVE-2025-8723 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution.
- Product
- Cloudflare Image Resizing
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Cloudflare Image Resizing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025Cloud SAML SSO - Single Sign On Login: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49264 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login cloud-sso-single-sign-on allows PHP Local File Inclusion.This issue affects Cloud SAML SSO - Single Sign On Login: from n/a through <= 1.0.18.
- Product
- Cloud SAML SSO - Single Sign On Login
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Cloud SAML SSO - Single Sign On Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2025Custom Word Cloud: Stored Cross-Site ScriptingCVE-2025-8317 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Custom Word Cloud
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Custom Word Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Jul 24, 2025Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to inCVE-2025-8071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2025CryptoCloud - Crypto Payment Gateway: Missing AuthorizationCVE-2025-48147 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n/a through <= 2.1.2.
- Product
- CryptoCloud - Crypto Payment Gateway
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update CryptoCloud - Crypto Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 26, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized modification of dataCVE-2025-4683 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts.
- Product
- MStore API – Create Native Android & iOS Apps On The Cloud
- Affected
- up to 4.17.5
- What to do
- Affects up to 4.17.5. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Limited privilege escalationCVE-2025-3438 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.
- Product
- MStore API – Create Native Android & iOS Apps On The Cloud
- Affected
- up to 4.17.4
- What to do
- Affects up to 4.17.4. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 24, 2025Mixcloud Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46501 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biancardi Mixcloud Embed mixcloud-embed allows Stored XSS.This issue affects Mixcloud Embed: from n/a through <= 2.2.0.
- Product
- Mixcloud Embed
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Mixcloud Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print): Insecure Direct Object ReferenceCVE-2025-1284 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xc_woo_printer_preview AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's invoices and orders which can contain sensitive information.
- Product
- Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 17, 2025Cart66 Cloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32653 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lee Blue Cart66 Cloud cart66-cloud allows Reflected XSS.This issue affects Cart66 Cloud: from n/a through <= 2.3.7.
- Product
- Cart66 Cloud
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update Cart66 Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Cart66 Cloud: Sensitive Information ExposureCVE-2025-2841 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
- Product
- Cart66 Cloud
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update Cart66 Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 1, 2025pCloud Backup: Missing AuthorizationCVE-2025-31755 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in josselynj pCloud Backup pcloud-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pCloud Backup: from n/a through <= 1.0.1.
- Product
- pCloud Backup
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update pCloud Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder: Stored Cross-Site ScriptingCVE-2024-12189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom widgets in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that you may need to recreate any custom widgets or reinstall the plugin to ensure the issue is adequately patched.
- Product
- WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025WooCommerce Fattureincloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30837 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristiano Zanca WooCommerce Fattureincloud woo-fattureincloud allows Reflected XSS.This issue affects WooCommerce Fattureincloud: from n/a through <= 2.6.7.
- Product
- WooCommerce Fattureincloud
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update WooCommerce Fattureincloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025WP Colorful Tag Cloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28865 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lionelroux WP Colorful Tag Cloud wp-colorful-tag-cloud allows Reflected XSS.This issue affects WP Colorful Tag Cloud: from n/a through <= 2.0.1.
- Product
- WP Colorful Tag Cloud
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update WP Colorful Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.