Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Jan 22, 2026DotLife: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods DotLife dotlife allows Reflected XSS.This issue affects DotLife: from n/a through < 4.9.5.
- Product
- DotLife
- What to do
- Update DotLife to the newest version.
Jul 16, 2025Dot html,php,xml etc pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52779 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.
- Product
- Dot html,php,xml etc pages
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dot html,php,xml etc pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025polka dots: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks polka dots allows Reflected XSS.This issue affects polka dots: from n/a through 1.2.
- Product
- polka dots
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update polka dots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Dot html,php,xml etc pages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48112 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.
- Product
- Dot html,php,xml etc pages
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dot html,php,xml etc pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2024Pardot: Missing AuthorizationCVE-2024-32148 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Salesforce Pardot.This issue affects Pardot: from n/a through 2.1.0.
- Product
- Pardot
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Pardot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Dotsquares WP Custom Post Template <= 1.0 versions.CVE-2023-41851 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dotsquares WP Custom Post Template <= 1.0 versions.
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions.CVE-2023-40559 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions.
- Fixed in
- 2.4.1
- What to do
- Update the plugin to 2.4.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions.CVE-2023-40561 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions.
- Fixed in
- 3.7.1
- What to do
- Update the plugin to 3.7.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <= 2.4.2 versions.CVE-2023-39158 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <= 2.4.2 versions.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions.CVE-2023-40212 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions.
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <= 2.1.5 versions.CVE-2023-39159 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 1, 2018An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress.CVE-2018-11486 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting (XSS) vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CSS textarea field, which will be loaded on every site page.
- Product
- MULTIDOTS Advance Search for WooCommerce
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update MULTIDOTS Advance Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlabs.threatpress.comlabs.threatpress.com
Jun 1, 2018MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier: Stored XSSCVE-2018-11485 · WordPress plugins & themes · reported by MITREMedium 6.1
The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack is possible by modifying the "referral_site" cookie to have an XSS payload, and placing an order.
- Product
- MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlabs.threatpress.comlabs.threatpress.com
May 31, 2018An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress.CVE-2018-11633 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings. The function woo_checkout_settings_page in the file class-woo-checkout-for-digital-goods-admin.php doesn't do any check against wp-admin/admin-post.php Cross-site request forgery (CSRF) and user capabilities.
- Product
- MULTIDOTS Woo Checkout for Digital Goods
- Affected
- 2.1 to 2.1
- What to do
- Affects 2.1 to 2.1. Update MULTIDOTS Woo Checkout for Digital Goods to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlabs.threatpress.comwordpress.org
May 31, 2018An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress.CVE-2018-11632 · WordPress plugins & themes · reported by MITREMedium 6.5
An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings via wp-admin/admin-post.php CSRF. There's no nonce or capability check in the whatsapp_share_setting_add_update() function.
- Product
- MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber
- Affected
- 1.0.8 to 1.0.8
- What to do
- Affects 1.0.8 to 1.0.8. Update MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlabs.threatpress.comwordpress.org
May 30, 2018An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress.CVE-2018-11580 · WordPress plugins & themes · reported by MITREMedium 5.4
An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.
- Product
- MULTIDOTS Mass Pages/Posts Creator
- Affected
- 1.2.2 to 1.2.2
- What to do
- Affects 1.2.2 to 1.2.2. Update MULTIDOTS Mass Pages/Posts Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlabs.threatpress.comwordpress.org
May 30, 2018class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change VulnerCVE-2018-11579 · WordPress plugins & themes · reported by MITREMedium 5.3
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
- Product
- MULTIDOTS WooCommerce Category Banner Management
- Affected
- 1.1.0 to 1.1.0
- What to do
- Affects 1.1.0 to 1.1.0. Update MULTIDOTS WooCommerce Category Banner Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlabs.threatpress.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.