Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

63 results · page 1 of 2

Oct 16, 2026WP Ghost (Hide My WP Ghost) – Security & Firewall: Stored Cross-Site ScriptingCVE-2026-89051 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
Product
WP Ghost (Hide My WP Ghost) – Security & Firewall
Affected
up to 7.0.12
What to do
Affects up to 7.0.12. Update WP Ghost (Hide My WP Ghost) – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2026Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.CVE-2026-96825 · WordPress plugins & themes · reported by PatchstackMedium 4.2
Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.
Affected
up to 5.4.8
What to do
Affects up to 5.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 19, 2026WP Ghost (Hide My WP Ghost) – Security & Firewall: Open RedirectCVE-2026-7527 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.
Product
WP Ghost (Hide My WP Ghost) – Security & Firewall
Affected
up to 7.0.02
What to do
Affects up to 7.0.02. Update WP Ghost (Hide My WP Ghost) – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Hide My WP Ghost: Does not verify that a request is a genuine WooCommerce request before disabling its firewallCVE-2026-86796 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows unauthenticated attackers to disable those protections and re-expose the concealed login and admin URLs on any request.
Product
Hide My WP Ghost
Fixed in
7.0.11
What to do
Update Hide My WP Ghost to 7.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…: Stored Cross-Site ScriptingCVE-2026-81754 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header, requiring no further interaction from the attacker once stored.
Product
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
Affected
up to 2.10.2
What to do
Affects up to 2.10.2. Update Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.CVE-2026-65437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.
Affected
up to 6.82
What to do
Affects up to 6.82. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Anti-Malware Security and Brute-Force Firewall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57691 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through <= 4.23.89.
Product
Anti-Malware Security and Brute-Force Firewall
Affected
up to 4.23.89
What to do
Affects up to 4.23.89. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.CVE-2026-39478 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.
Affected
up to 4.23.87
What to do
Affects up to 4.23.87. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 5, 2026All-In-One Security (AIOS) – Security and Firewall: Stored Cross-Site ScriptingCVE-2026-8438 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator's browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administra
Product
All-In-One Security (AIOS) – Security and Firewall
Affected
up to 5.4.7
What to do
Affects up to 5.4.7. Update All-In-One Security (AIOS) – Security and Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2026WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to reaCVE-2021-47977 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the file parameter. Attackers can send requests to the duplicator_download action via admin-ajax.php with path traversal sequences to access sensitive system files outside the intended directory.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record gotmls.net gotmls.net
Mar 25, 2026RSFirewall!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25341 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through <= 1.1.45.
Product
RSFirewall!
Affected
up to 1.1.45
What to do
Affects up to 1.1.45. Update RSFirewall! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2026Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2026-1490 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.
Product
Spam protection, Anti-Spam, FireWall by CleanTalk
Affected
up to 6.71
What to do
Affects up to 6.71. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2025Login Security, FireWall, Malware removal by CleanTalk: Stored Cross-Site ScriptingCVE-2025-13604 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Login Security, FireWall, Malware removal by CleanTalk
Affected
up to 2.168
What to do
Affects up to 2.168. Update Login Security, FireWall, Malware removal by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Astra Security Suite – Firewall & Malware Scan: Arbitrary file uploadsCVE-2025-11521 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads and an easily guessable key in all versions up to, and including, 0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Astra Security Suite – Firewall & Malware Scan
Affected
up to 0.2
What to do
Affects up to 0.2. Update Astra Security Suite – Firewall & Malware Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 29, 2025Anti-Malware Security and Brute-Force Firewall: Arbitrary File ReadCVE-2025-11705 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Anti-Malware Security and Brute-Force Firewall
Affected
up to 4.23.81
What to do
Affects up to 4.23.81. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Aug 2, 2025BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security: Sensitive Information ExposureCVE-2025-6722 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire_* directory that automatically gets created and stores potentially sensitive files without any access restrictions. This makes it possible for unauthenticated attackers to extract sensitive data from various files like config.ini, debug.log, and more when directory listing is enabled on the server and the ~/wp-content/plugins/index.php file is missing or ignored.
Product
BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security
Affected
up to 4.5
What to do
Affects up to 4.5. Update BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2025Security Ninja – WordPress Security Plugin & Firewall: Arbitrary File ReadCVE-2025-8009 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242 via the 'get_file_source' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data, including the contents of any file on the server.
Product
Security Ninja – WordPress Security Plugin & Firewall
Affected
up to 5.242
What to do
Affects up to 5.242. Update Security Ninja – WordPress Security Plugin & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2025RSFirewall!: Path TraversalCVE-2025-7518 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
RSFirewall!
Affected
up to 1.1.42
What to do
Affects up to 1.1.42. Update RSFirewall! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2025WP Ghost (Hide My WP Ghost) – Security & Firewall: Path TraversalCVE-2025-2056 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information.
Product
WP Ghost (Hide My WP Ghost) – Security & Firewall
Affected
up to 5.4.01
What to do
Affects up to 5.4.01. Update WP Ghost (Hide My WP Ghost) – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2025DefendWP Firewall: Missing AuthorizationCVE-2025-22280 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through <= 1.1.0.
Product
DefendWP Firewall
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update DefendWP Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 12, 2025WP Ghost (Hide My WP Ghost) – Security & Firewall: Login Page DislcosureCVE-2024-13794 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to discover the hidden login page location.
Product
WP Ghost (Hide My WP Ghost) – Security & Firewall
Affected
up to 5.3.02
What to do
Affects up to 5.3.02. Update WP Ghost (Hide My WP Ghost) – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024Spam protection, AntiSpam, FireWall by CleanTalk: Missing AuthorizationCVE-2023-33996 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spam protection, AntiSpam, FireWall by CleanTalk: from n/a through 6.10.
Product
Spam protection, AntiSpam, FireWall by CleanTalk
Affected
up to 6.10
What to do
Affects up to 6.10. Update Spam protection, AntiSpam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 26, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2024-10781 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
Product
Spam protection, Anti-Spam, FireWall by CleanTalk
Affected
up to 6.44
What to do
Affects up to 6.44. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 26, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2024-10542 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
Product
Spam protection, Anti-Spam, FireWall by CleanTalk
Affected
up to 6.43.2
What to do
Affects up to 6.43.2. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024Hide My WP Ghost – Security & Firewall: Reflected Cross-Site ScriptingCVE-2024-10825 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Product
Hide My WP Ghost – Security & Firewall
Affected
up to 5.3.01
What to do
Affects up to 5.3.01. Update Hide My WP Ghost – Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024NinjaFirewall: Authenticated PHAR DeserializationCVE-2021-4451 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall).
Product
NinjaFirewall
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update NinjaFirewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Sep 5, 2024Security, Antivirus, Firewall – S.A.F: IP Address SpoofingCVE-2022-4529 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Security, Antivirus, Firewall – S.A.F plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.3.5. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.
Product
Security, Antivirus, Firewall – S.A.F
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Security, Antivirus, Firewall – S.A.F to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 31, 2024Web Application Firewall: IP Address SpoofingCVE-2022-4539 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.
Product
Web Application Firewall
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Web Application Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 31, 2024IP Vault – WP Firewall: IP Address SpoofingCVE-2022-4536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.
Product
IP Vault – WP Firewall
Affected
up to 1.1
What to do
Affects up to 1.1. Update IP Vault – WP Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 4, 2024All In One WP Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52147 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4.
Product
All In One WP Security & Firewall
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update All In One WP Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Anti-Malware Security and Brute-Force Firewall: Improper Control of Generation of Code ('Code Injection')CVE-2024-22144 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Eli Scheetz Anti-Malware Security and Brute-Force Firewall gotmls allows Code Injection.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through 4.21.96.
Product
Anti-Malware Security and Brute-Force Firewall
Affected
up to 4.21.96
What to do
Affects up to 4.21.96. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024All In One WP Security & Firewall: Cross-Site Request Forgery (CSRF)CVE-2024-30468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6.
Product
All In One WP Security & Firewall
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update All In One WP Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing caCVE-2024-2172 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator.
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 29, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Cross-Site Request Forgery (CSRF)CVE-2023-51696 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20.
Product
Spam protection, Anti-Spam, FireWall by CleanTalk
Affected
up to 6.20
What to do
Affects up to 6.20. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 7, 2024All-In-One Security (AIOS) – Security and Firewall: Reflected Cross-Site ScriptingCVE-2024-1037 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
All-In-One Security (AIOS) – Security and Firewall
Affected
up to 5.2.5
What to do
Affects up to 5.2.5. Update All-In-One Security (AIOS) – Security and Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 8, 2024Defender Security – Malware Scanner, Login Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51490 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
Product
Defender Security – Malware Scanner, Login Security & Firewall
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Defender Security – Malware Scanner, Login Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Cross-Site Request Forgery (CSRF)CVE-2023-51535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20.
Product
Spam protection, Anti-Spam, FireWall by CleanTalk
Affected
up to 6.20
What to do
Affects up to 6.20. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2023QueryWall: Plug'n Play Firewall: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2492 · WordPress plugins & themes · reported by WPScanHigh 7.2
The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
QueryWall: Plug'n Play Firewall
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update QueryWall: Plug'n Play Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023AAWP: Can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companiesCVE-2022-4794 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
Product
AAWP
Fixed in
3.12.3
What to do
Update AAWP to 3.12.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2022RSFirewall tries to identify the original IP address by looking at different HTTP headers.CVE-2021-4226 · WordPress plugins & themes · reported by WPScanCritical 9.8
RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented.
Fixed in
1.1.25
What to do
Update the plugin to 1.1.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2022Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.CVE-2022-44737 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 25, 2022Spam protection, AntiSpam, FireWall by CleanTalk: Does not validate ids before using them in a SQL statementCVE-2022-3302 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statement, which could lead to SQL injection exploitable by high privilege users such as admin
Product
Spam protection, AntiSpam, FireWall by CleanTalk
Fixed in
5.185.1
What to do
Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.185.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Wordfence Security – Firewall & Malware Scan: Stored Cross-Site ScriptingCVE-2022-3144 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.
Product
Wordfence Security – Firewall & Malware Scan
Affected
up to 7.6.0
What to do
Affects up to 7.6.0. Update Wordfence Security – Firewall & Malware Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 29, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape some parameters before outputting them back in an admin dashboardCVE-2022-2599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting
Product
Anti-Malware Security and Brute-Force Firewall
Fixed in
4.21.83
What to do
Update Anti-Malware Security and Brute-Force Firewall to 4.21.83 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to maliCVE-2022-1028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
Product
WordPress Security Firewall, Malware Scanner, Secure Login and Backup
Fixed in
4.2.1
What to do
Update WordPress Security Firewall, Malware Scanner, Secure Login and Backup to 4.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022All In One WP Security & Firewall: Does not validateCVE-2021-25102 · WordPress plugins & themes · reported by WPScanMedium 4.7
The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk
Product
All In One WP Security & Firewall
Fixed in
4.4.11
What to do
Update All In One WP Security & Firewall to 4.4.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the QUERY_STRING before outputting it back in an admin pageCVE-2022-0953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
Product
Anti-Malware Security and Brute-Force Firewall
Fixed in
4.20.96
What to do
Update Anti-Malware Security and Brute-Force Firewall to 4.20.96 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the POST data before outputting it back in attributes of an admin pageCVE-2021-25101 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
Product
Anti-Malware Security and Brute-Force Firewall
Fixed in
4.20.94
What to do
Update Anti-Malware Security and Brute-Force Firewall to 4.20.94 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress PluCVE-2021-24295 · WordPress plugins & themes · reported by WPScanHigh 7.5
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
Product
Spam protection, AntiSpam, FireWall by CleanTalk
Fixed in
5.153.4
What to do
Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.153.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Feb 10, 2021Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-secuCVE-2020-29171 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.
Fixed in
4.4.6
What to do
Update the plugin to 4.4.6 or newer.
Full record and what to do →NVD record github.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.