Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

17 results

Feb 27, 2026The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0.CVE-2024-10938 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025HTACCESS IP Blocker: Cross-Site Request Forgery (CSRF)CVE-2025-60170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Taraprasad Swain HTACCESS IP Blocker htaccess-ip-blocker allows Stored XSS.This issue affects HTACCESS IP Blocker: from n/a through <= 1.0.
Product
HTACCESS IP Blocker
Affected
up to 1.0
What to do
Affects up to 1.0. Update HTACCESS IP Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Browser Caching with .htaccess: Cross-Site Request Forgery (CSRF)CVE-2025-31439 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in tobias_.MerZ Browser Caching with .htaccess allows Cross Site Request Forgery. This issue affects Browser Caching with .htaccess: from 1.2.1 through n/a.
Product
Browser Caching with .htaccess
What to do
Update Browser Caching with .htaccess to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 16, 2025Download Manager: Doesn't prevent directory listing on web servers that don't use htaccessCVE-2024-13126 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
Product
Download Manager
Fixed in
3.3.07
What to do
Update Download Manager to 3.3.07 or newer.
Full record and what to do →NVD record wpscan.com
Mar 3, 2025.htaccess Login block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27269 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anton Aleksandrov .htaccess Login block htaccess-login-block allows Reflected XSS.This issue affects .htaccess Login block: from n/a through <= 0.9a.
Product
.htaccess Login block
Affected
up to 0.9a
What to do
Affects up to 0.9a. Update .htaccess Login block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Htaccess File Editor: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-22773 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Htaccess File Editor: from n/a through <= 1.0.19.
Product
Htaccess File Editor
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Htaccess File Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Htaccess File Editor: Incorrect AuthorizationCVE-2024-49256 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Htaccess File Editor: from n/a through <= 1.0.18.
Product
Htaccess File Editor
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update Htaccess File Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Akismet htaccess writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49316 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zodiac Akismet htaccess writer akismet-htaccess-writer allows Reflected XSS.This issue affects Akismet htaccess writer: from n/a through <= 1.0.1.
Product
Akismet htaccess writer
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Akismet htaccess writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2022The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess fCVE-2022-1166 · WordPress plugins & themes · reported by WPScanMedium 5.3
The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.
Fixed in
4.6.6.1
What to do
Update the plugin to 4.6.6.1 or newer.
Full record and what to do →NVD record themeforest.net wpscan.com
Dec 14, 2021.htaccess Redirect: Reflected Cross-Site ScriptingCVE-2021-38361 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redirect.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.3.1.
Product
.htaccess Redirect
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update .htaccess Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2020The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF.CVE-2020-8658 · WordPress plugins & themes · reported by MITREHigh 8.8
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.
Product
BestWebSoft Htaccess
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update BestWebSoft Htaccess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Oct 23, 2019The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x beCVE-2015-9515 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org
Aug 22, 2019The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess fCVE-2015-9340 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
Product
wp-file-upload
Fixed in
3.0.0
What to do
Update wp-file-upload to 3.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 13, 2019The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.CVE-2017-18496 · WordPress plugins & themes · reported by MITREMedium 6.1
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
Product
htaccess
Fixed in
1.7.6
What to do
Update htaccess to 1.7.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Dec 1, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Server-side request forgery (SSRF)CVE-2014-8749 · WordPress plugins & themes · reported by MITREMedium 5
Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
Affected
up to .51
What to do
Affects up to .51. Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wordpress.org
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: SQL injectionCVE-2014-7959 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
What to do
Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Cross-site scripting (XSS)CVE-2014-7958 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
What to do
Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.