Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Oct 6, 2026Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.CVE-2026-39727 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
- Affected
- up to 4.1.12
- What to do
- Affects up to 4.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026WC Fields Factory: Does not properly restrict access to its field-management AJAX actionCVE-2026-93508 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
- Product
- WC Fields Factory
- Fixed in
- 4.1.11
- What to do
- Update WC Fields Factory to 4.1.11 or newer.
Sep 23, 2026WC Fields Factory: Does not properly restrict access toCVE-2026-93507 · WordPress plugins & themes · reported by WPScanLow 3.3
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
- Product
- WC Fields Factory
- Fixed in
- 4.1.11
- What to do
- Update WC Fields Factory to 4.1.11 or newer.
Aug 13, 2026The Link Factory WordPress plugin is a backdoor.CVE-2026-15413 · WordPress plugins & themes · reported by WPScanCritical 10
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).
- What to do
- Update the plugin to the newest version.
Dec 18, 2025Manufactory: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58944 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Manufactory manufactory allows PHP Local File Inclusion.This issue affects Manufactory: from n/a through <= 1.4.
- Product
- Manufactory
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Manufactory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Events Maker by dFactory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62941 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Events Maker by dFactory events-maker allows Stored XSS.This issue affects Events Maker by dFactory: from n/a through <= 1.6.14.
- Product
- Events Maker by dFactory
- Affected
- up to 1.6.14
- What to do
- Affects up to 1.6.14. Update Events Maker by dFactory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 15, 2025Icons Factory: Arbitrary File DeletionCVE-2025-7778 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delete_files() function in all versions up to, and including, 1.6.12. This makes it possible for unauthenticated attackers to to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Icons Factory
- Affected
- up to 1.6.12
- What to do
- Affects up to 1.6.12. Update Icons Factory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 13, 2024WPFactory Helper: Reflected Cross-Site ScriptingCVE-2024-8656 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WPFactory Helper
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update WPFactory Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 7, 2023Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory fuCVE-2021-4337 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Apr 17, 2023WC Fields Factory: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0277 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WC Fields Factory
- Affected
- up to 4.1.5
- What to do
- Affects up to 4.1.5. Update WC Fields Factory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Feb 6, 2023Gallery Factory Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Gallery Factory Lite
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Gallery Factory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2021WebFactory Ltd: Cross-Site Request Forgery (CSRF)CVE-2021-36908 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions.
- Product
- WebFactory Ltd
- Fixed in
- 5.99
- What to do
- Update WebFactory Ltd to 5.99 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 22, 2019The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-15322 · WordPress plugins & themes · reported by MITRECritical 9.8
The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.
- Product
- shortcode-factory
- Fixed in
- 2.8
- What to do
- Update shortcode-factory to 2.8 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.CVE-2015-9321 · WordPress plugins & themes · reported by MITREMedium 6.1
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
- Product
- shortcode-factory
- Fixed in
- 1.1.1
- What to do
- Update shortcode-factory to 1.1.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.