Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
142 results · page 1 of 3
Oct 27, 2026Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the currCVE-2026-104349 · Other software · Adobe · reported by AdobeHigh 7.3
Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Creative Cloud Desktop Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth rangeCVE-2026-63243 · Other software · Creative Labs · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Medium 4.3
An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication.
- Product
- Creative Sound Blaster Katana V2, V2X, SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firCVE-2026-55981 · Other software · Creative Labs · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Critical 9.6
A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device.
- Product
- Creative Sound Blaster Katana V2, V2X, SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Bridge - Creative Multipurpose: Stored Cross-Site ScriptingCVE-2026-15609 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bridge - Creative Multipurpose
- Affected
- up to 30.8.9.1
- What to do
- Affects up to 30.8.9.1. Update Bridge - Creative Multipurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbridge.qodeinteractive.comwordfence.com
Aug 25, 2026Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding.CVE-2026-26211 · Other software · Creativeitem · reported by VulnCheckMedium 4.8
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the page header. The h4 occurrence is parsed as markup, so HTML placed in the system name field is rendered as markup and any event handler it carries runs. The login page is served without authentication, so the stored value executes in the browser of every visitor who loads it, including visitors who are not signed in, within the origin that serves the login form and alongside the credential fields on it. Storing the value requires an administrator session; the resulting script runs for unauthenticated visitors and persists until the setting is changed.
- Product
- Ekushey Project Manager CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Aug 6, 2026The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated CVE-2026-3430 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.CVE-2026-65547 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary CVE-2026-66031 · Other software · Creativeitem · reported by VulnCheckMedium 5.1
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.
- Product
- Ekushey Project Manager CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Jul 27, 2026Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitraryCVE-2026-66030 · Other software · Creativeitem · reported by VulnCheckMedium 5.1
Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized.
- Product
- Ekushey Project Manager CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Jul 27, 2026Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary CVE-2026-66029 · Other software · Creativeitem · reported by VulnCheckMedium 5.1
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Manage Clients or Manage Client Projects pages where client names are rendered unsanitized.
- Product
- Ekushey Project Manager CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Jul 27, 2026Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicCVE-2026-66028 · Other software · Creativeitem · reported by VulnCheckHigh 7.1
Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access.
- Product
- Ekushey Project Manager CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netgithub.com
Jul 14, 2026Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the conCVE-2026-48344 · Other software · Adobe · reported by AdobeHigh 7.8
Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Creative Cloud Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the currCVE-2026-48272 · Other software · Adobe · reported by AdobeHigh 7.8
Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Creative Cloud Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP commandsCVE-2019-25729 · Other software · simcy_creative · reported by VulnCheckCritical 9.3
PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP commands through the CSRF-TOKEN cookie parameter. Attackers can craft malicious cookie values containing template injection payloads like shell_exec() to execute system commands and retrieve sensitive information from the server.
- Product
- PDF Signer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netcodecanyon.net
May 19, 2026Creative Mail – Easier WordPress & WooCommerce Email Marketing: SQL InjectionCVE-2026-3985 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `has_checkout_consent()` method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Creative Mail – Easier WordPress & WooCommerce Email Marketing
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update Creative Mail – Easier WordPress & WooCommerce Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 28, 2026A vulnerability was detected in DV0x creative-ad-agent up to 751b9e5146604dc65049bd0f62dcbdad6212f8a3.CVE-2026-7271 · Other software · DV0x · reported by VulDBMedium 5.5
A vulnerability was detected in DV0x creative-ad-agent up to 751b9e5146604dc65049bd0f62dcbdad6212f8a3. Impacted is an unknown function of the file server/sdk-server.ts of the component creative-ad-agent-server. Performing a manipulation of the argument req.params results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 3d255865a957f3740b8724dd914502c0f44d4970. Applying a patch is the recommended action to fix this issue.
- Product
- creative-ad-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted fileCVE-2026-30266 · Other software · Deepcool · reported by MITREHigh 7.8
Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file
- Product
- Deepcreative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026PQ Addons – Creative Elementor Widgets: Stored Cross-Site ScriptingCVE-2026-1397 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PQ Addons – Creative Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on the html_tag parameter in the PQ Section Title widget. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- PQ Addons – Creative Elementor Widgets
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PQ Addons – Creative Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2026Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the striCVE-2025-71179 · Other software · Creativeitem · reported by MITREMedium 6.1
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. These vulnerabilities are distinct from the patch for CVE-2023-4119, which only fixed XSS in query and sort_by parameters to the /academy/home/courses endpoint.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netcreativeitem.com
Jan 15, 2026Kalium 3 | Creative WordPress & WooCommerce: Unauthorized email sendingCVE-2025-12895 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf.
- Product
- Kalium 3 | Creative WordPress & WooCommerce
- Affected
- up to 3.29
- What to do
- Affects up to 3.29. Update Kalium 3 | Creative WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocumentation.laborator.cothemeforest.net
Dec 15, 2025Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads.CVE-2023-53876 · Other software · Creativeitem · reported by VulnCheckMedium 5.1
Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacademylms.netexploit-db.com
Dec 9, 2025Creative Cloud Desktop versions 6.4.0.361 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that coCVE-2025-64896 · Other software · Adobe · reported by AdobeMedium 5.5
Creative Cloud Desktop versions 6.4.0.361 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to disrupt the application's functionality by manipulating temporary files. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Creative Cloud Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025Featured Post Creative: Missing AuthorizationCVE-2025-66106 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through <= 1.5.5.
- Product
- Featured Post Creative
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Featured Post Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2025Creative Cloud Desktop versions 6.7.0.278 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitCVE-2025-54271 · Other software · Adobe · reported by AdobeMedium 5.6
Creative Cloud Desktop versions 6.7.0.278 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary file system write. A low-privileged attacker could exploit the timing between the check and use of a resource, potentially allowing unauthorized modifications to files. Exploitation of this issue does not require user interaction.
- Product
- Creative Cloud Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing.CVE-2025-56749 · Other software · Creativeitem · reported by MITRECritical 9.4
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing bruteCVE-2025-56748 · Other software · Creativeitem · reported by MITREMedium 6.4
Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackCVE-2025-56746 · Other software · Creativeitem · reported by MITRELow 2.2
Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated useCVE-2025-56747 · Other software · Creativeitem · reported by MITREMedium 6.5
Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affectingCVE-2025-40992 · Other software · Creativeitem · reported by cve-coordination@incibe.esMedium 5.1
Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affecting to 'name' parameter via POST. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal his/her cookie session details.
- Product
- Sociopro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clienCVE-2025-40991 · Other software · Creativeitem · reported by cve-coordination@incibe.esMedium 5.1
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_file/upload/xxxx", affecting to "description" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
- Product
- Ekushey CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clienCVE-2025-40990 · Other software · Creativeitem · reported by cve-coordination@incibe.esMedium 5.1
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
- Product
- Ekushey CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clienCVE-2025-40989 · Other software · Creativeitem · reported by cve-coordination@incibe.esMedium 5.1
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_message/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
- Product
- Ekushey CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats.CVE-2025-59039 · Other software · prebid · reported by GitHubCritical 9.3
Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.
- Product
- prebid-universal-creative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonatype.com
Jul 22, 2025The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerabCVE-2025-7644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 20, 2025Creative Contact Form: Cross-Site Request Forgery (CSRF)CVE-2025-52794 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through <= 1.0.0.
- Product
- Creative Contact Form
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Creative Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025PIMP - Creative MultiPurpose: Deserialization of Untrusted DataCVE-2025-31398 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpose: from n/a through 1.7.
- Product
- PIMP - Creative MultiPurpose
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update PIMP - Creative MultiPurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Featured Post Creative: Missing AuthorizationCVE-2023-30488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through 1.2.7.
- Product
- Featured Post Creative
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Featured Post Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Creative Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51822 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keonthemes Creative Blocks creative-blocks allows Stored XSS.This issue affects Creative Blocks: from n/a through <= 1.0.1.
- Product
- Creative Blocks
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Creative Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Datasets Manager by Arttia Creative: Unrestricted Upload of File with Dangerous TypeCVE-2024-52375 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative datasets-manager-by-arttia-creative.This issue affects Datasets Manager by Arttia Creative: from n/a through <= 1.5.
- Product
- Datasets Manager by Arttia Creative
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Datasets Manager by Arttia Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2024Anih - Creative Agency: Stored Cross-Site ScriptingCVE-2024-9775 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Anih - Creative Agency WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2024 due to an incomplete blacklist, insufficient input sanitization, and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Anih - Creative Agency
- Affected
- up to 2024
- What to do
- Affects up to 2024. Update Anih - Creative Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 14, 2024An issue in Creative Labs Pte Ltd com.creative.apps.xficonnect 2.00.02 allows a remote attacker to obtain sensitive information via the firmware update process.CVE-2024-48795 · Other software · creative_labs_pte_ltd · reported by MITREMedium 5.3
An issue in Creative Labs Pte Ltd com.creative.apps.xficonnect 2.00.02 allows a remote attacker to obtain sensitive information via the firmware update process.
- Product
- com_creative_apps_xficonnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhk.creative.com
Jul 9, 2024Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain CVE-2024-38959 · Other software · creativeitem · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter.
- Product
- academy_lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024Creative Cloud Desktop versions 6.1.0.587 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in a security feature CVE-2024-34116 · Other software · Adobe · reported by AdobeHigh 7.1
Creative Cloud Desktop versions 6.1.0.587 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to load and execute malicious libraries, leading to arbitrary file delete. Exploitation of this issue requires user interaction.
- Product
- Creative Cloud Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Apr 9, 2024Invitation Code Content Restriction Plugin from CreativeMinds: Reflected Cross-Site ScriptingCVE-2022-4965 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Invitation Code Content Restriction Plugin from CreativeMinds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘target_id’ parameter in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Invitation Code Content Restriction Plugin from CreativeMinds
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Invitation Code Content Restriction Plugin from CreativeMinds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcminds.comwordfence.com
Apr 2, 2024Creative Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-2924 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Creative Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.5.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Creative Addons for Elementor
- Affected
- up to 1.5.12
- What to do
- Affects up to 1.5.12. Update Creative Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 29, 2024Creative Image Slider – Responsive Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30447 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Solutions Creative Image Slider – Responsive Slider Plugin allows Reflected XSS.This issue affects Creative Image Slider – Responsive Slider Plugin: from n/a through 2.1.3.
- Product
- Creative Image Slider – Responsive Slider
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Creative Image Slider – Responsive Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 12, 2024Brooklyn | Creative Multi-Purpose Responsive: Deserialization of Untrusted DataCVE-2024-24926 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
- Product
- Brooklyn | Creative Multi-Purpose Responsive
- Affected
- up to 4.9.7.6
- What to do
- Affects up to 4.9.7.6. Update Brooklyn | Creative Multi-Purpose Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 12, 2024Brooklyn | Creative Multi-Purpose Responsive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24927 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme allows Reflected XSS.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
- Product
- Brooklyn | Creative Multi-Purpose Responsive
- Affected
- up to 4.9.7.6
- What to do
- Affects up to 4.9.7.6. Update Brooklyn | Creative Multi-Purpose Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023TheGem - Creative Multi-Purpose & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50892 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9.1.
- Product
- TheGem - Creative Multi-Purpose & WooCommerce
- Affected
- up to 5.9.1
- What to do
- Affects up to 5.9.1. Update TheGem - Creative Multi-Purpose & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023Uncode - Creative & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51501 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Uncode - Creative & WooCommerce WordPress Theme: from n/a through 2.8.6.
- Product
- Uncode - Creative & WooCommerce
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Uncode - Creative & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.