Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

17 results

Jun 27, 2026Spexo: Unauthorized accessCVE-2026-12471 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set of plugins.
Product
Spexo
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Spexo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Apr 8, 2026NewsExo: Cross-Site Request Forgery (CSRF)CVE-2026-39618 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through <= 7.1.
Product
NewsExo
Affected
up to 7.1
What to do
Affects up to 7.1. Update NewsExo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026flexo-posts-manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52762 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio flexo-posts-manager flexo-posts-manager allows Reflected XSS.This issue affects flexo-posts-manager: from n/a through <= 1.0001.
Product
flexo-posts-manager
Affected
up to 1.0001
What to do
Affects up to 1.0001. Update flexo-posts-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025flexoslider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52764 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marielav flexoslider flexoslider allows Reflected XSS.This issue affects flexoslider: from n/a through <= 1.0004.
Product
flexoslider
Affected
up to 1.0004
What to do
Affects up to 1.0004. Update flexoslider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2025Spexo Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-8208 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spexo Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spexo Addons for Elementor
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Spexo Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 14, 2025flexo-social-gallery: Cross-Site Request Forgery (CSRF)CVE-2025-52769 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in flexostudio flexo-social-gallery flexo-social-gallery allows Cross Site Request Forgery.This issue affects flexo-social-gallery: from n/a through <= 1.0006.
Product
flexo-social-gallery
Affected
up to 1.0006
What to do
Affects up to 1.0006. Update flexo-social-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Flexo Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50052 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio Flexo Counter flexo-countdown allows Reflected XSS.This issue affects Flexo Counter: from n/a through <= 1.0001.
Product
Flexo Counter
Affected
up to 1.0001
What to do
Affects up to 1.0001. Update Flexo Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Flexo Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23472 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio Flexo Slider flexo-slider allows Reflected XSS.This issue affects Flexo Slider: from n/a through <= 1.0013.
Product
Flexo Slider
Affected
up to 1.0013
What to do
Affects up to 1.0013. Update Flexo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates: Unauthorized accessCVE-2024-13335 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoder_theme_install_func() function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install a theme.
Product
Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 30, 2024Marketing Automation by AZEXO: Incorrect Privilege AssignmentCVE-2024-50506 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80.
Product
Marketing Automation by AZEXO
Affected
up to 1.27.80
What to do
Affects up to 1.27.80. Update Marketing Automation by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Marketing Automation by AZEXO: Unrestricted Upload of File with Dangerous TypeCVE-2024-50480 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Upload a Web Shell to a Web Server.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80.
Product
Marketing Automation by AZEXO
Affected
up to 1.27.80
What to do
Affects up to 1.27.80. Update Marketing Automation by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2023Page Builder by AZEXO: Cross-Site Request ForgeryCVE-2023-3055 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_save' function. This makes it possible for unauthenticated attackers to update the post content and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Page Builder by AZEXO
Affected
up to 1.27.133
What to do
Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 2, 2023Page Builder by AZEXO: Unauthorized modification of dataCVE-2023-3053 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and post status.
Product
Page Builder by AZEXO
Affected
up to 1.27.133
What to do
Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2023Page Builder by AZEXO: Cross-Site Request ForgeryCVE-2023-3052 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_add_post', 'azh_duplicate_post', 'azh_update_post' and 'azh_remove_post' functions. This makes it possible for unauthenticated attackers to create, modify, and delete a post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Page Builder by AZEXO
Affected
up to 1.27.133
What to do
Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2023Page Builder by AZEXO: Stored Cross-Site ScriptingCVE-2023-3051 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azh_post' shortcode in versions up to, and including, 1.27.133 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder by AZEXO
Affected
up to 1.27.133
What to do
Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.CVE-2020-15364 · WordPress plugins & themes · reported by MITREMedium 6.1
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
Product
Nexos
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.CVE-2020-15363 · WordPress plugins & themes · reported by MITRECritical 9.8
The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.
Product
Nexos
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.