Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

48 results

Oct 28, 2026the update_fees AJAX handler that: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorizationCVE-2026-118757 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
Product
the update_fees AJAX handler that
Fixed in
1.1.10.9
What to do
Update the update_fees AJAX handler that to 1.1.10.9 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 23, 2026The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode prCVE-2026-94263 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Topcontent: Does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted contentCVE-2026-88903 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.
Product
Topcontent
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Topcontent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Disable Users: Does not enforce its account-disabling control on all authentication pathsCVE-2026-88827 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
Product
Disable Users
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Disable Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Disable and Remove Google Fonts | GDPR & DSGVO friendly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95595 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS. This issue affects Disable and Remove Google Fonts | GDPR & DSGVO friendly: from n/a through 2.0.2.
Product
Disable and Remove Google Fonts | GDPR & DSGVO friendly
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Disable and Remove Google Fonts | GDPR & DSGVO friendly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 18, 2026Hide My WP Ghost: Does not properly validate a loopback security-check request before disabling its login and URL hiding protectionCVE-2026-86800 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange, allowing unauthenticated attackers to re-expose the concealed WordPress login page location.
Product
Hide My WP Ghost
Fixed in
7.0.11
What to do
Update Hide My WP Ghost to 7.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Hide My WP Ghost: Does not verify that a request is a genuine WooCommerce request before disabling its firewallCVE-2026-86796 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.
Product
Hide My WP Ghost
Fixed in
7.0.11
What to do
Update Hide My WP Ghost to 7.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026EONSR AEO Agent: Does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the postCVE-2026-11588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts that execute in the browser of any visitor, including administrators (Stored XSS).
Product
EONSR AEO Agent
Affected
up to 3.7.9
What to do
Affects up to 3.7.9. Update EONSR AEO Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026User Registration & Membership: Does not enforce the site's registration-disabled settingCVE-2026-16736 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
Product
User Registration & Membership
Fixed in
5.2.6
What to do
Update User Registration & Membership to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Everest Toolkit: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13158 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
Product
Everest Toolkit
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Everest Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Demo Import: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13157 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
Product
Demo Import
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 15, 2026WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF tokCVE-2016-20083 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxes on the Write/Edit page via POST and GET requests to the options-general.php endpoint.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 27, 2026Disable Comments for Any Post Types (Remove comments): Authentication Bypass Using an Alternate Path or ChannelCVE-2026-42749 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows Password Recovery Exploitation.This issue affects Disable Comments for Any Post Types (Remove comments): from n/a through <= 1.3.0.
Product
Disable Comments for Any Post Types (Remove comments)
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Disable Comments for Any Post Types (Remove comments) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2026Disable Admin Notices – Hide Dashboard Notifications: Cross-Site Request ForgeryCVE-2026-2410 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing nonce validation in the `showPageContent()` function. This makes it possible for unauthenticated attackers to add arbitrary URLs to the blocked redirects list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Disable Admin Notices – Hide Dashboard Notifications
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Disable Admin Notices – Hide Dashboard Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2025Meks Quick Plugin Disabler: Cross-Site Request Forgery (CSRF)CVE-2025-68083 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Meks Meks Quick Plugin Disabler meks-quick-plugin-disabler allows Cross Site Request Forgery.This issue affects Meks Quick Plugin Disabler: from n/a through <= 1.0.
Product
Meks Quick Plugin Disabler
Affected
up to 1.0
What to do
Affects up to 1.0. Update Meks Quick Plugin Disabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2025Disable Content Editor For Specific Template: Cross-Site Request ForgeryCVE-2025-12072 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing nonce validation on template configuration updates. This makes it possible for unauthenticated attackers to add or delete template configurations via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
Disable Content Editor For Specific Template
Affected
up to 2.0
What to do
Affects up to 2.0. Update Disable Content Editor For Specific Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2025BP Disable Activation Reloaded: Cross-Site Request Forgery (CSRF)CVE-2025-57983 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Damian BP Disable Activation Reloaded bp-disable-activation-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Disable Activation Reloaded: from n/a through <= 1.2.1.
Product
BP Disable Activation Reloaded
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update BP Disable Activation Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been cCVE-2025-8047 · WordPress plugins & themes · reported by WPScanCritical 9.8
The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert marketing security services. Users that pay are added to allowedDomains to suppress the popup.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2025Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: Missing AuthorizationCVE-2025-49973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: from n/a through <= 1.0.10.
Product
Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Right Click Disable OR Ban: Cross-Site Request Forgery (CSRF)CVE-2025-39548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Right Click Disable OR Ban right-click-disable-or-ban allows Stored XSS.This issue affects Right Click Disable OR Ban: from n/a through <= 1.1.17.
Product
Right Click Disable OR Ban
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update Right Click Disable OR Ban to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Simple Trackback Disabler: Cross-Site Request Forgery (CSRF)CVE-2025-31448 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in misteraon Simple Trackback Disabler simple-trackback-disabler allows Cross Site Request Forgery.This issue affects Simple Trackback Disabler: from n/a through <= 1.4.
Product
Simple Trackback Disabler
Affected
up to 1.4
What to do
Affects up to 1.4. Update Simple Trackback Disabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Disable Elementor Editor Translation: Missing AuthorizationCVE-2025-22671 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Leap13 Disable Elementor Editor Translation disable-elementor-editor-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Disable Elementor Editor Translation: from n/a through <= 1.0.2.
Product
Disable Elementor Editor Translation
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Disable Elementor Editor Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2025Disable Auto Updates: Cross-Site Request ForgeryCVE-2024-13336 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'disable-auto-updates' page. This makes it possible for unauthenticated attackers to disable all auto updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Disable Auto Updates
Affected
up to 1.4
What to do
Affects up to 1.4. Update Disable Auto Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 19, 2024Disable Admin Notices individually: Cross-Site Request Forgery (CSRF)CVE-2024-52420 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Disable Admin Notices individually disable-admin-notices allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through <= 1.4.0.
Product
Disable Admin Notices individually
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Disable Admin Notices individually to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2024Disable Comments | WPZest: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32135 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPZest Disable Comments | WPZest.This issue affects Disable Comments | WPZest: from n/a through 1.51.
Product
Disable Comments | WPZest
Affected
up to 1.51
What to do
Affects up to 1.51. Update Disable Comments | WPZest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 20241 click disable all: Cross-Site Request Forgery (CSRF)CVE-2024-21749 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au 1 click disable all.This issue affects 1 click disable all: from n/a through 1.0.1.
Product
1 click disable all
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update 1 click disable all to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1861 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_truncate_scan_table() function in all versions up to, and including, 4.52. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate the scan table.
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.52
What to do
Affects up to 4.52. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1860 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_add_whitelist() function in all versions up to, and including, 4.51. This makes it possible for unauthenticated attackers to add their IP Address to the whitelist circumventing protection
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.51
What to do
Affects up to 4.51. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 28, 2023Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Cross-Site Request Forgery (CSRF)CVE-2023-50858 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34.
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.34
What to do
Affects up to 4.34. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 26, 2023Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro: Does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version)CVE-2023-6114 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.
Product
Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro
Fixed in
1.5.7.1
What to do
Update Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro to 1.5.7.1 or newer.
Full record and what to do →NVD record drive.google.com wpscan.com
Dec 18, 2023Disable User Login: Cross-Site Request Forgery (CSRF)CVE-2023-47806 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through 1.3.7.
Product
Disable User Login
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Disable User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Disabler: Cross-Site Request Forgery (CSRF)CVE-2023-37998 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3.
Product
Disabler
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update Disabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versioCVE-2023-34029 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versions.
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 27, 2023File Manager Advanced Shortcode: Does not adequately prevent uploading files with disallowed MIME typesCVE-2023-2068 · WordPress plugins & themes · reported by WPScanCritical 9.8
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
Product
File Manager Advanced Shortcode
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update File Manager Advanced Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 8, 2023Enable/Disable Auto Login when Register: Does not have CSRF check in placeCVE-2023-0522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Enable/Disable Auto Login when Register
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Enable/Disable Auto Login when Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3880 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Fixed in
4.20
What to do
Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to 4.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2022Disable User Login: Does not have authorisation and CSRF checksCVE-2022-2350 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will.
Product
Disable User Login
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Disable User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 20, 2022Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress.CVE-2022-29427 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress.
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 18, 2022SearchIQ: Contains a flag to disable the verification of CSRF noncesCVE-2022-0780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers access to the siq_ajax AJAX action and allowing them to perform Cross-Site Scripting attacks due to the lack of sanitisation and escaping in the customCss parameter
Product
SearchIQ
Fixed in
3.9
What to do
Update SearchIQ to 3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022MapPress Maps for: Allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" functionCVE-2022-0537 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.
Product
MapPress Maps for
Fixed in
2.73.13
What to do
Update MapPress Maps for to 2.73.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Similar Posts: Allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDITCVE-2021-24537 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML set to true) via the 'widget_rrm_similar_posts_condition' widget setting of the plugin.
Product
Similar Posts
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Similar Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 15, 2020The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for thCVE-2020-28650 · WordPress plugins & themes · reported by MITREMedium 6.4
The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles.
Product
WPBakery
Fixed in
6.4.1
What to do
Update WPBakery to 6.4.1 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Nov 2, 2020WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.CVE-2020-28033 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record lists.debian.org lists.fedoraproject.org
Jan 9, 2020A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenaCVE-2020-6168 · WordPress plugins & themes · reported by MITREHigh 7.6
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings (impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting).
Affected
up to 2.10
What to do
Affects up to 2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme upCVE-2019-15650 · WordPress plugins & themes · reported by MITREMedium 4.3
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
Product
stops-core-theme-and-plugin-updates
Fixed in
8.0.5
What to do
Update stops-core-theme-and-plugin-updates to 8.0.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Dec 19, 2018Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_CVE-2018-20231 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.
Product
Cross Site Request Forgery (CSRF) in the two-factor-authentication
Fixed in
1.3.13
What to do
Update Cross Site Request Forgery (CSRF) in the two-factor-authentication to 1.3.13 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication oCVE-2014-2550 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php.
Product
Cross-site request forgery (CSRF) vulnerability in the Disable Comments
Fixed in
1.0.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Disable Comments to 1.0.4 or newer.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com security.dxw.com
Dec 30, 2008Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allCVE-2008-5752 · WordPress plugins & themes · reported by MITREMedium 4.3
Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details are obtained from third party information.
Product
Page Flip Image Gallery
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update Page Flip Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.