Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

324new WordPress flaws this week

390,007entries in the database

14 results

Oct 28, 2026Customer Engagement System: Does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to itCVE-2026-115225 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.
Product
Customer Engagement System
Fixed in
2.0.2
What to do
Update Customer Engagement System to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Customer Engagement System: Does not safely build the SQL statements that store a popup's page and category visibility rulesCVE-2026-115224 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
Product
Customer Engagement System
Fixed in
2.0.2
What to do
Update Customer Engagement System to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Icegram Engage – Popups, Optins, CTAs & Lead Generation: Second-order SQL InjectionCVE-2026-16087 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious id value is first persisted to post meta via the save_campaign_preview() AJAX action (gated by a nonce check and edit_post capability, requiring Editor-level access or above), and only executed as SQL when a subsequent preview request triggers get_message_data() to interpolate the stored value directly into a SQL IN() clause without $wpdb->prepare() or integer casting.
Product
Icegram Engage – Popups, Optins, CTAs & Lead Generation
Affected
up to 3.1.42
What to do
Affects up to 3.1.42. Update Icegram Engage – Popups, Optins, CTAs & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2026Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.CVE-2026-52698 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13486 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Icegram Engage
Fixed in
3.1.32
What to do
Update Icegram Engage to 3.1.32 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13482 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Icegram Engage
Fixed in
3.1.32
What to do
Update Icegram Engage to 3.1.32 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 6, 2025Icegram Engage: Does not sanitise and escape some of its Campaign settingsCVE-2024-12302 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks
Product
Icegram Engage
Fixed in
3.1.32
What to do
Update Icegram Engage to 3.1.32 or newer.
Full record and what to do →NVD record wpscan.com
Nov 12, 2024Slickstream: Engagement and Conversions: Stored Cross-Site ScriptingCVE-2024-10179 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slick-grid shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slickstream: Engagement and Conversions
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Slickstream: Engagement and Conversions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 15, 2024WP ULike – The Ultimate Engagement Toolkit for Websites: Cross-Site Request ForgeryCVE-2024-9649 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7.4. This is due to missing or incorrect nonce validation on the wp_ulike_delete_history_api() function. This makes it possible for unauthenticated attackers to delete engagements via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP ULike – The Ultimate Engagement Toolkit for Websites
Affected
up to 4.7.4
What to do
Affects up to 4.7.4. Update WP ULike – The Ultimate Engagement Toolkit for Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 12, 2024The WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration ForCVE-2024-8757 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the linked_user_id parameter in all versions up to, and including, 3.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 1, 2024Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51532 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building allows Stored XSS.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.19.
Product
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building
Affected
up to 3.1.19
What to do
Affects up to 3.1.19. Update Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: Cross-Site Request Forgery (CSRF)CVE-2023-52119 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.18.
Product
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building
Affected
up to 3.1.18
What to do
Affects up to 3.1.18. Update Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2023Icegram Engage: Does not escape a parameter before outputting it back in an attributeCVE-2023-2398 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Icegram Engage
Fixed in
3.1.12
What to do
Update Icegram Engage to 3.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in resize.php in the WebEngage plugin before 2.0.1 for WordPress allows remote attackers to inject arbitrary web scriptCVE-2014-4574 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in resize.php in the WebEngage plugin before 2.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the height parameter.
Product
Cross-site scripting (XSS) vulnerability in resize.php in the WebEngage
Fixed in
2.0.1
What to do
Update Cross-site scripting (XSS) vulnerability in resize.php in the WebEngage to 2.0.1 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.