Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
189 results · page 1 of 4
Oct 28, 2026A security flaw has been discovered in dfm feedfinder2 up to 0.0.4.CVE-2026-118586 · Other software · dfm · reported by VulDBMedium 6.9
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- feedfinder2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the querCVE-2026-110911 · Other software · Wheels · reported by MITRECritical 9.8
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability has been found in highwarden Super Store Finder up to 3.8.CVE-2026-108541 · Other software · highwarden · reported by VulDBLow 2.1
A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- Super Store Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netvuldb.com
Sep 12, 2026Album Cover Finder: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-84047 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Album Cover Finder
- Affected
- up to 0.7.0
- What to do
- Affects up to 0.7.0. Update Album Cover Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.UCVE-2026-82617 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 10
The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders(...) and then applies them to untrusted text through RegexNameFinder.find(String[]) or RegexNameFinder.find(String) can be driven into super-linear backtracking or into unbounded matcher recursion by a small crafted input. For the EMAIL pattern, a long run of local-part characters that is never followed by an @ forces the matcher to re-scan to end-of-input from every starting offset. Cost grows quadratically with input length: an input of approximately 32 KB consumes several seconds of CPU in a single find() call and returns no match, and each doubling of the input multiplies the cost roughly four-fold. For the URL pattern, the query-string sub-expression nests a capturing repetition inside an outer repetition. The JDK matcher recurses once per query token, so an input of approximately 4 KB containing many &-separated tokens exhausts the thread stack and causes java.lang.Sta
- Product
- Apache OpenNLP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 31, 2026elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.CVE-2026-81891 · Other software · Studio-42 · reported by GitHubHigh 8.1
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not applied, and allowPutMime() permits extraction even when uploadDeny blocks text/x-php. An attacker with ZIP upload permission can extract PHP-executable files into a web-accessible files/ directory and achieve remote code execution when the server executes those extensions. This issue is fixed in version 2.1.70.
- Product
- elFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.CVE-2026-81890 · Other software · Studio-42 · reported by GitHubMedium 5.4
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.
- Product
- elFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.CVE-2026-81889 · Other software · Studio-42 · reported by GitHubHigh 8.6
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70.
- Product
- elFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.CVE-2026-81768 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
- Affected
- up to 7.10
- What to do
- Affects up to 7.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.CVE-2026-28161 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.CVE-2026-28159 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 11, 2026Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code.CVE-2026-48813 · Other software · david-a-wheeler · reported by GitHubHigh 8.7
Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder's standard terminal output, with many effects. Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary XML attributes into SonarQube outputs via output_sonar(). It impacts those who use flawfinder to evaluate intentionally malicious filenames or file contents. This issue has been fully patched in Version 2.0.20 (released 2026-05-16). There is no configuration-based workaround within older versions of flawfinder. If an immediate upgrade is not possible, users can mitigate the risk by pre-scanning filenames, inspecting raw output, and/or restricting untrusted inputs.
- Product
- flawfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Super Store Finder: Does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL queryCVE-2026-12965 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.
- Product
- Super Store Finder
- Fixed in
- 7.11
- What to do
- Update Super Store Finder to 7.11 or newer.
Jun 7, 2026the elFinder connector that: WordPress Augmented-Reality plugin contains a remote code executionCVE-2023-54350 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files in the file_manager directory and execute them on the server.
- Product
- the elFinder connector that
- What to do
- Update the elFinder connector that to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
May 27, 2026elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.CVE-2026-44521 · Other software · Studio-42 · reported by GitHubHigh 8.8
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vulnerability in the elFinder MySQL volume driver (elFinderVolumeMySQL) allows any logged-in user, including users with read-only access to the affected volume, to inject SQL through a crafted target file hash. Successful exploitation can lead to unauthorized data disclosure and denial of service. This vulnerability only affects installations configured to use the MySQL volume driver. This vulnerability is fixed in 2.1.68.
- Product
- elFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.CVE-2026-35221 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2026Skim is a fuzzy finder designed to through files, lines, and commands.CVE-2026-41414 · Other software · skim-rs · reported by GitHubHigh 7.4
Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.yml checks out attacker-controlled fork code and executes it via cargo run, with access to SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN (contents:write). No gates prevent exploitation - any GitHub user can trigger this by opening a pull request from a fork. This vulnerability is fixed with commit bf63404ad51985b00ed304690ba9d477860a5a75.
- Product
- skim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.CVE-2026-41247 · Other software · Studio-42 · reported by GitHubHigh 8.9
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.
- Product
- elFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-CVE-2026-34415 · Other software · thexerteproject · reported by VulnCheckCritical 9.3
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.
- Product
- xerteonlinetoolkits
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/conneCVE-2026-34414 · Other software · thexerteproject · reported by VulnCheckHigh 7.1
Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.
- Product
- xerteonlinetoolkits
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connecCVE-2026-34413 · Other software · thexerteproject · reported by VulnCheckHigh 8.8
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.
- Product
- xerteonlinetoolkits
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Doofinder for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2026-39542 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through <= 2.10.13.
- Product
- Doofinder for WooCommerce
- Affected
- up to 2.10.13
- What to do
- Affects up to 2.10.13. Update Doofinder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanaCVE-2018-25158 · Other software · Chamilo · reported by VulnCheckHigh 8.7
Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module. Attackers can upload files with image headers in the social myfiles section, rename them to PHP extensions, and execute arbitrary code by accessing the uploaded files.
- Product
- Chamillo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 11, 2026Office Product Key Finder 1.5.4 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the registration code CVE-2020-37203 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
Office Product Key Finder 1.5.4 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the registration code input. Attackers can create a specially crafted text file and paste it into the 'Name and Key' field to trigger an application crash.
- Product
- Nsauditor Office Product Key Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnsauditor.comexploit-db.com
Feb 11, 2026GTalk Password Finder 2.2.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration keyCVE-2020-37180 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
GTalk Password Finder 2.2.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key. Attackers can generate a 1000-character payload and paste it into the 'Key' field to trigger an application crash.
- Product
- Nsauditor GTalk Password Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnsauditor.comexploit-db.com
Feb 11, 2026APKF Product Key Finder 2.5.8.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field.CVE-2020-37179 · Other software · Nsasoft · reported by VulnCheckMedium 4.6
APKF Product Key Finder 2.5.8.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field. Attackers can generate a 1000-character payload and paste it into the registration name field to trigger an application crash.
- Product
- Nsauditor APKF Product Key Finder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnsauditor.comexploit-db.com
Jan 15, 2026A clickjacking vulnerability exists in the web portal of Juniper Networks Paragon Automation (Pathfinder, Planner, Insights) due to the application's failure toCVE-2025-52987 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 5.1
A clickjacking vulnerability exists in the web portal of Juniper Networks Paragon Automation (Pathfinder, Planner, Insights) due to the application's failure to set appropriate X-Frame-Options and X-Content-Type HTTP headers. This vulnerability allows an attacker to trick users into interacting with the interface under the attacker's control. This issue affects all versions of Paragon Automation (Pathfinder, Planner, Insights) before 24.1.1.
- Product
- Paragon Automation (Pathfinder, Planner, Insights)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.juniper.netsupportportal.juniper.net
Jan 2, 2026A path traversal vulnerability has been reported to affect several product versions.CVE-2025-53594 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.4
A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Qfinder Pro Mac 7.13.0 and later Qsync for Mac 5.1.5 and later QVPN Device Client for Mac 2.2.8 and later
- Product
- Qfinder Pro Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Pathfinder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58885 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pathfinder pathfinder allows PHP Local File Inclusion.This issue affects Pathfinder: from n/a through <= 1.16.
- Product
- Pathfinder
- Affected
- up to 1.16
- What to do
- Affects up to 1.16. Update Pathfinder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 10, 2025WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder filCVE-2024-58283 · Other software · wbce · reported by VulnCheckHigh 8.7
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwbce-cms.org
Dec 5, 2025In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.CVE-2016-20023 · Other software · CKSource · reported by MITREMedium 5
In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.
- Product
- CKFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.cksource.comckeditor.com
Nov 19, 2025Pet-Manager – Petfinder: Stored Cross-Site ScriptingCVE-2025-12710 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pet-Manager – Petfinder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kwm-petfinder shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Pet-Manager – Petfinder
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Pet-Manager – Petfinder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 14, 2025CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function.CVE-2025-63830 · Other software · Cksource · reported by MITREMedium 6.1
CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content.
- Product
- Ckfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordckeditor.comgithub.com
Nov 1, 2025Service Finder Bookings: Privilege escalationCVE-2025-6574 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- Service Finder Bookings
- What to do
- Update Service Finder Bookings to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
Nov 1, 2025Service Finder Bookings: Privilege escalationCVE-2025-5949 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to processing a password change request. This makes it possible for authenticated attackers with subscriber access or higher to reset other users' passwords, including those of admins.
- Product
- Service Finder Bookings
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update Service Finder Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 29, 2025Super Store Finder: Cross-Site Request Forgery (CSRF)CVE-2025-58939 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in highwarden Super Store Finder superstorefinder-wp allows Cross Site Request Forgery.This issue affects Super Store Finder: from n/a through <= 7.5.
- Product
- Super Store Finder
- Affected
- up to 7.5
- What to do
- Affects up to 7.5. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Vehicle Parts Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49911 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Reflected XSS.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.
- Product
- WooCommerce Vehicle Parts Finder
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WooCommerce Vehicle Parts Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Vehicle Parts Finder: Deserialization of Untrusted DataCVE-2025-49380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.
- Product
- WooCommerce Vehicle Parts Finder
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WooCommerce Vehicle Parts Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2025Auto Bulb Finder for: Stored Cross-Site ScriptingCVE-2025-9858 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_vehicle' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Auto Bulb Finder for
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update Auto Bulb Finder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2025Service Finder Bookings: Privilege escalationCVE-2025-5948 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claim_business AJAX action. This makes it possible for unauthenticated attackers to login as any user including admins. Please note that subscriber privileges or brute-forcing are needed when completing the business takeover. The claim_id is needed to takeover the admin account, but brute-forcing is a practical approach to obtaining valid IDs.
- Product
- Service Finder Bookings
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update Service Finder Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Sep 19, 2025Service Finder SMS System: Authentication bypassCVE-2025-5955 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary users.
- Product
- Service Finder SMS System
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Service Finder SMS System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Sep 9, 2025Super Store Finder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47571 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in highwarden Super Store Finder superstorefinder-wp allows PHP Local File Inclusion.This issue affects Super Store Finder: from n/a through < 7.8.
- Product
- Super Store Finder
- What to do
- Update Super Store Finder to the newest version.
Aug 20, 2025Super Store Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49413 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Store Finder superstorefinder-wp allows Reflected XSS.This issue affects Super Store Finder: from n/a through <= 7.6.
- Product
- Super Store Finder
- Affected
- up to 7.6
- What to do
- Affects up to 7.6. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Super Store Finder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52720 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.5.
- Product
- Super Store Finder
- Affected
- up to 7.5
- What to do
- Affects up to 7.5. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2025Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions.CVE-2025-0818 · WordPress plugins & themes · reported by WordfenceMedium 6.5
Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.
- What to do
- Update the plugin to the newest version.
Aug 1, 2025Service Finder Bookings: Privilege escalationCVE-2025-5947 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins.
- Product
- Service Finder Bookings
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update Service Finder Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jul 31, 2025Service Finder SMS System: Privilege escalationCVE-2025-5954 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the aonesms_fn_savedata_after_signup() function. This makes it possible for unauthenticated attackers to register as an administrator user.
- Product
- Service Finder SMS System
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Service Finder SMS System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jul 15, 2025An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connectorCVE-2025-34111 · Other software · Tiki Software Community Association · reported by VulnCheckCritical 9.3
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendor_extra/elfinder/.
- Product
- Wiki CMS Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comtiki.org
Jul 10, 2025An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File UploCVE-2025-34100 · Other software · BuilderEngine · reported by VulnCheckCritical 9.3
An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload operations, allowing an attacker to upload a malicious .php file and subsequently execute arbitrary PHP code on the server under the context of the web server process. While the root vulnerability lies within the jQuery File Upload component, BuilderEngine’s improper integration and lack of access controls expose this functionality to unauthenticated users, resulting in full remote code execution.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comsupport.alertlogic.com
Jul 4, 2025Service Finder Booking: Incorrect Privilege AssignmentCVE-2025-23970 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booking: from n/a through <= 6.1.
- Product
- Service Finder Booking
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Service Finder Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.