Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

196 results · page 1 of 4

Oct 27, 2026The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnCVE-2026-109999 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires only that the chatbot module is active with at least one configured bot; the attacker stores the payload via three unauthenticated REST calls, and the JavaScript widget auto-poll then delivers it to any administrator who opens wp-admin/index.php.
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Bulk Page Generator – LPagery: Authorization bypassCVE-2026-110019 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, and delete LPagery-managed WordPress pages and bulk page-generation processes that are otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable by any authenticated user.
Product
Bulk Page Generator – LPagery
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Bulk Page Generator – LPagery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2026AI Content Generator Marketing: Does not enforce a nonce or capability check on some of its AJAX actionsCVE-2026-85118 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
Product
AI Content Generator Marketing
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update AI Content Generator Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Data Tables Generator by Supsystic: Stored Cross-Site ScriptingCVE-2026-14877 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Data Tables Generator by Supsystic
Affected
up to 1.12.03
What to do
Affects up to 1.12.03. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Data Tables Generator by Supsystic: Stored Cross-Site ScriptingCVE-2026-96648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin's 'access_roles' setting, which is a documented and explicitly supported plugin feature that grants lower-privileged users access to the dtgs_nonce required to reach the vulnerable updateRows action handler.
Product
Data Tables Generator by Supsystic
Affected
up to 1.15.1
What to do
Affects up to 1.15.1. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 5, 2026WP Dummy Content Generator: Missing AuthorizationCVE-2026-39763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0.
Product
WP Dummy Content Generator
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 19, 2026Business Name Generator: Does not sanitise and escape some of its settingsCVE-2025-15698 · WordPress plugins & themes · reported by WPScanLow 3.5
The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Business Name Generator
Affected
up to 1.3
What to do
Affects up to 1.3. Update Business Name Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 15, 2026The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functionsCVE-2026-87792 · WordPress plugins & themes · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.7
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com acn.gov.it
Sep 12, 2026MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO: Generic SQL InjectionCVE-2026-85198 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page.
Product
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2026Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates: Does not include an authorization check on a REST route that returns stored account dataCVE-2026-16984 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration.
Product
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates
Fixed in
3.7.1
What to do
Update Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 24, 2026Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.CVE-2026-32560 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 8, 2026AI Copilot – Content Generator: Authorization bypassCVE-2026-14526 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier.
Product
AI Copilot – Content Generator
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update AI Copilot – Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Visualizer – Tables & Charts Manager with Built-in AI Generator: Stored Cross-Site ScriptingCVE-2026-15653 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visualizer – Tables & Charts Manager with Built-in AI Generator
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Visualizer – Tables & Charts Manager with Built-in AI Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026AI Copilot – Content Generator: Generic SQL InjectionCVE-2026-13009 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required waic-nonce is emitted on the front-end whenever the [waic_form] or [aiwu-form] shortcode is rendered, enabling contributor-level users who can publish shortcodes to obtain a valid nonce and reach the vulnerable AJAX handler, which performs no capability check beyond nonce verification when the shortcodes are not already embedded in a page.
Product
AI Copilot – Content Generator
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update AI Copilot – Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2026Instant Image Generator: Server-Side Request Forgery (SSRF)CVE-2026-57413 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in bdthemes Instant Image Generator ai-image allows Server Side Request Forgery.This issue affects Instant Image Generator: from n/a through <= 2.1.4.
Product
Instant Image Generator
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Instant Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026PDF Generator for: Server-Side Request Forgery (SSRF)CVE-2026-57407 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Server Side Request Forgery.This issue affects PDF Generator for WordPress: from n/a through <= 1.6.2.
Product
PDF Generator for
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update PDF Generator for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 1, 2026Visualizer – Tables & Charts Manager with Built-in AI Generator: Authorization bypassCVE-2026-13468 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — including charts in draft, private, pending, future, or trash status — as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is particularly impactful because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated callers, whereas this plugin-registered route circumvents that protection entirely.
Product
Visualizer – Tables & Charts Manager with Built-in AI Generator
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Visualizer – Tables & Charts Manager with Built-in AI Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2026Invoice Generator: Privilege escalationCVE-2026-12415 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.
Product
Invoice Generator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Invoice Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 24, 2026Invoice Generator: Account TakeoverCVE-2026-12416 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied `reset_activation_code` POST parameter and the target user's stored `forgot_email` user meta — a check that trivially evaluates to true (`'' == ''`) for any user who has never initiated a forgot-password request, which applies to administrators under normal conditions. This makes it possible for unauthenticated attackers to supply an arbitrary user ID via the `reset_user_id` POST parameter, bypass the activation code check entirely by omitting `reset_activation_code`, and set the target account's password to an attacker-chosen value, enabling full takeover of any account on the site, including administrator accounts.
Product
Invoice Generator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Invoice Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2026Crawlomatic Multipage Scraper Post Generator: Remote Code ExecutionCVE-2026-9009 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter_content function. This is due to passing the attacker-supplied 'callback_raw' shortcode attribute directly into call_user_func() with no sanitization or allowlist validation, relying solely on an is_callable() check that permits dangerous PHP built-ins such as system, shell_exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.
Product
Crawlomatic Multipage Scraper Post Generator
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Crawlomatic Multipage Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 19, 2026診断ジェネレータ作成プラグイン (Diagnosis Generator): Stored Cross-Site ScriptingCVE-2026-5293 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode.
Product
診断ジェネレータ作成プラグイン (Diagnosis Generator)
Affected
up to 1.4.16
What to do
Affects up to 1.4.16. Update 診断ジェネレータ作成プラグイン (Diagnosis Generator) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 2, 2026AI ChatBot with ChatGPT and Content Generator by AYS: Unauthorized access and modification of dataCVE-2026-1336 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the store_data() and get_chatgpt_api_key() functions in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to view, modify or delete the plugin's ChatGPT API key. The vulnerability was partially fixed in version 2.7.5 and fully fixed in version 2.7.6
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Affected
up to 2.7.5
Fixed in
2.7.5
What to do
Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.7.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2026Simple Archive Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68880 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
Product
Simple Archive Generator
Affected
up to 5.2
What to do
Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026AI ChatBot with ChatGPT and Content Generator by AYS: Missing AuthorizationCVE-2026-25338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.7.4.
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026iXML – Google XML sitemap generator: Reflected Cross-Site ScriptingCVE-2025-14076 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The iXML – Google XML sitemap generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'iXML_email' parameter in all versions up to, and including, 0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
iXML – Google XML sitemap generator
Affected
up to 0.6
What to do
Affects up to 0.6. Update iXML – Google XML sitemap generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2026Orbisius Random Name Generator: Stored Cross-Site ScriptingCVE-2026-1893 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name_generator' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Orbisius Random Name Generator
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Orbisius Random Name Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026Extended Random Number Generator: Stored Cross-Site ScriptingCVE-2026-0681 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Extended Random Number Generator
Affected
up to 1.1
What to do
Affects up to 1.1. Update Extended Random Number Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026Flex QR Code Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24614 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Devsbrain Flex QR Code Generator flex-qr-code-generator allows DOM-Based XSS.This issue affects Flex QR Code Generator: from n/a through <= 1.2.10.
Product
Flex QR Code Generator
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Ai Image Alt Text Generator for WP: Missing AuthorizationCVE-2026-24579 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.9.
Product
Ai Image Alt Text Generator for WP
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2026DK PDF – WordPress PDF Generator: Server-Side Request ForgeryCVE-2025-14793 · WordPress plugins & themes · reported by WordfenceMedium 5
The DK PDF – WordPress PDF Generator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3.0 via the 'addContentToMpdf' function. This makes it possible for authenticated attackers, author level and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
DK PDF – WordPress PDF Generator
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update DK PDF – WordPress PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Contact Form vCard Generator: Unauthorized access of dataCVE-2025-13717 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Contact Form vCard Generator plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wp_gvccf_check_download_request' function in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to export sensitive Contact Form 7 submission data via the 'wp-gvc-cf-download-id' parameter, including names, phone numbers, email addresses, and messages.
Product
Contact Form vCard Generator
Affected
up to 2.4
What to do
Affects up to 2.4. Update Contact Form vCard Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 31, 2025Featured Image Generator: Missing AuthorizationCVE-2025-62747 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Aum Watcharapon Featured Image Generator featured-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image Generator: from n/a through <= 1.3.4.
Product
Featured Image Generator
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Featured Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: Missing AuthorizationCVE-2025-62154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in recorp AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One ai-content-writing-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: from n/a through <= 1.1.7.
Product
AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Serial Codes Generator and Validator with WooCommerce Support: Missing AuthorizationCVE-2025-62091 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serial Codes Generator and Validator with WooCommerce Support: from n/a through <= 2.8.2.
Product
Serial Codes Generator and Validator with WooCommerce Support
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update Serial Codes Generator and Validator with WooCommerce Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Simple Archive Generator: Cross-Site Request Forgery (CSRF)CVE-2025-49346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
Product
Simple Archive Generator
Affected
up to 5.2
What to do
Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025PDF Thumbnail Generator: Cross-Site Request Forgery (CSRF)CVE-2025-67469 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in kubiq PDF Thumbnail Generator pdf-thumbnail-generator allows Cross Site Request Forgery.This issue affects PDF Thumbnail Generator: from n/a through <= 1.4.
Product
PDF Thumbnail Generator
Affected
up to 1.4
What to do
Affects up to 1.4. Update PDF Thumbnail Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2025Flex QR Code Generator: Arbitrary file uploadsCVE-2025-12673 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Flex QR Code Generator
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 5, 2025User Generator and Importer: Cross-Site Request ForgeryCVE-2025-12879 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the "Import Using CSV File" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
Product
User Generator and Importer
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update User Generator and Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 27, 2025AI ChatBot with ChatGPT and Content Generator by AYS: Unauthorized accessCVE-2025-13381 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ays_chatgpt_save_wp_media' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload media files.
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2025AI ChatBot with ChatGPT and Content Generator by AYS: Server-Side Request ForgeryCVE-2025-13378 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.0 via the ays_chatgpt_pinecone_upsert function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025AI Engine for WordPress: ChatGPT, GPT Content Generator: Arbitrary File ReadCVE-2025-13380 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai_update_post' AJAX endpoint and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
AI Engine for WordPress: ChatGPT, GPT Content Generator
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update AI Engine for WordPress: ChatGPT, GPT Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 21, 2025S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator: Arbitrary file uploadsCVE-2025-12973 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeFile() function in all versions up to, and including, 1.7.8. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 12, 2025Data Tables Generator by Supsystic: Arbitrary file deletionCVE-2025-12089 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Data Tables Generator by Supsystic
Affected
up to 1.10.45
What to do
Affects up to 1.10.45. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images: Unauthorized loss of dataCVE-2025-12113 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the atgai_delete_api_key() function in all versions up to, and including, 1.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the API key connected to the site.
Product
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 6, 2025AI ChatBot with ChatGPT and Content Generator by AYS: Insertion of Sensitive Information Into Sent DataCVE-2025-62039 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Retrieve Embedded Sensitive Data.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.6.6.
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Ai Image Alt Text Generator for WP: Missing AuthorizationCVE-2025-58207 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.5.
Product
Ai Image Alt Text Generator for WP
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 31, 2025Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Unauthorized modification of dataCVE-2025-11816 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disconnect_account_request() function in all versions up to, and including, 3.5.1. This makes it possible for unauthenticated attackers to disconnect the site from its API plan.
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025UPC/EAN/GTIN Code Generator: Cross-Site Request Forgery (CSRF)CVE-2025-62009 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Cross Site Request Forgery.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2.
Product
UPC/EAN/GTIN Code Generator
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update UPC/EAN/GTIN Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Shortcode Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49945 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kylegetson Shortcode Generator shortcode-generator allows Reflected XSS.This issue affects Shortcode Generator: from n/a through <= 1.1.
Product
Shortcode Generator
Affected
up to 1.1
What to do
Affects up to 1.1. Update Shortcode Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2025Flex QR Code Generator: Arbitrary file uploadsCVE-2025-10041 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Flex QR Code Generator
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.