Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Sep 19, 2026VikRentItems Flexible Rental Management System: Does not sanitise and escape some of its parameters before using them in SQL statementsCVE-2026-88926 · WordPress plugins & themes · reported by WPScanHigh 8.6
The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.
- Product
- VikRentItems Flexible Rental Management System
- Fixed in
- 1.2.4
- What to do
- Update VikRentItems Flexible Rental Management System to 1.2.4 or newer.
Aug 5, 2026VikRentItems – Flexible Rental Management System: Stored Cross-Site ScriptingCVE-2026-16143 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the saveorder() function, which stores the raw email value via VikRequest::getString() (applying only sanitize_text_field(), which does not neutralize HTML attribute-breaking characters such as double quotes), and in the editorder template which echoes the stored custmail value into an HTML input element's value attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- VikRentItems – Flexible Rental Management System
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update VikRentItems – Flexible Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 2, 2026FluentBoards: Does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to accessCVE-2026-14938 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.
- Product
- FluentBoards
- Fixed in
- 1.95.3
- What to do
- Update FluentBoards to 1.95.3 or newer.
Jul 17, 2026Royal Addons for Elementor: Does not check the post status of menu items or the templates they reference in one of its REST endpointsCVE-2026-13402 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
- Product
- Royal Addons for Elementor
- Fixed in
- 1.7.1063
- What to do
- Update Royal Addons for Elementor to 1.7.1063 or newer.
Dec 12, 2025VikRentItems Flexible Rental Management System: Reflected Cross-Site ScriptingCVE-2025-14049 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- VikRentItems Flexible Rental Management System
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update VikRentItems Flexible Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2025Eulerpool Research Systems: Stored Cross-Site ScriptingCVE-2025-10128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Eulerpool Research Systems
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Eulerpool Research Systems to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 8, 2025Ditty: Lacks authorization and authentication for requests to its displayItems endpointCVE-2025-8085 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
- Product
- Ditty
- Fixed in
- 3.1.58
- What to do
- Update Ditty to 3.1.58 or newer.
Feb 13, 2025TinyMCE Advanced qTranslate fix editor problems: Cross-Site Request Forgery (CSRF)CVE-2025-26582 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems allows Stored XSS.This issue affects TinyMCE Advanced qTranslate fix editor problems: from n/a through <= 1.0.0.
- Product
- TinyMCE Advanced qTranslate fix editor problems
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update TinyMCE Advanced qTranslate fix editor problems to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Marketplace Items: Stored Cross-Site ScriptingCVE-2024-12437 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Marketplace Items
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Marketplace Items to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 7, 2025Marketplace Items: Stored Cross-Site ScriptingCVE-2024-12439 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'marketplace' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Marketplace Items
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Marketplace Items to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 17, 2024Special Feed Items: Does not have CSRF check in some placesCVE-2024-8051 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Special Feed Items
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Special Feed Items to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2024Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, MembCVE-2023-52200 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.
- Affected
- up to 4.0.22
- What to do
- Affects up to 4.0.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 27, 2023Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site.CVE-2023-51700 · WordPress plugins & themes · reported by GitHubMedium 6.4
Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts.
- Fixed in
- 1.0.1
- What to do
- Update the plugin to 1.0.1 or newer.
Jul 18, 2023Repute InfoSystems ARMember: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-47421 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.
- Product
- Repute InfoSystems ARMember
- What to do
- Update Repute InfoSystems ARMember to the newest version.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 26, 2022Menu Item Visibility Control: Doesn't sanitize and validate the "Visibility logic" option for WordPress menu itemsCVE-2021-24942 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.
- Product
- Menu Item Visibility Control
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Menu Item Visibility Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022WP RSS Aggregator: Does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the responseCVE-2022-0189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- WP RSS Aggregator
- Fixed in
- 4.20
- What to do
- Update WP RSS Aggregator to 4.20 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 23, 2021HM Multiple Roles: Does not have any access control to prevent low privilege users to set themselvesCVE-2021-24602 · WordPress plugins & themes · reported by WPScanHigh 8.8
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
- Product
- HM Multiple Roles
- Fixed in
- 1.3
- What to do
- Update HM Multiple Roles to 1.3 or newer.
Aug 2, 2021get_results() and get_items() functions in the Survey Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24459 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_results() and get_items() functions in the Survey Maker
- Fixed in
- 1.5.6
- What to do
- Update get_results() and get_items() functions in the Survey Maker to 1.5.6 or newer.
May 5, 2021In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that thCVE-2021-24293 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.
- Product
- NextGEN Gallery Pro
- Fixed in
- 3.1.11
- What to do
- Update NextGEN Gallery Pro to 3.1.11 or newer.
Feb 4, 2020A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malCVE-2020-8615 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
- Product
- A CSRF vulnerability in the Tutor LMS
- Fixed in
- 1.5.3
- What to do
- Update A CSRF vulnerability in the Tutor LMS to 1.5.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Oct 17, 2017Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers CVE-2015-7806 · WordPress plugins & themes · reported by MITRECritical 9.8
Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors.
- Product
- Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager
- Fixed in
- 1.7.3
- What to do
- Update Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager to 1.7.3 or newer.
Full record and what to do →NVD recordappcheck-ng.complugins.trac.wordpress.org
Oct 1, 2007the internal browser in i-Systems Feedreader 3.10: Cross-zone scriptingCVE-2007-5161 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-zone scripting vulnerability in the internal browser in i-Systems Feedreader 3.10 allows remote attackers to inject arbitrary web script or HTML via an item in a feed, as demonstrated by a WordPress blog update. NOTE: this was originally reported as XSS.
- Product
- the internal browser in i-Systems Feedreader 3.10
- What to do
- Update the internal browser in i-Systems Feedreader 3.10 to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.