Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Oct 28, 2026The Innovative Form Builder – IvyForms: Arbitrary File UploadCVE-2026-109384 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route.
- Product
- The Innovative Form Builder – IvyForms
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update The Innovative Form Builder – IvyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.CVE-2026-97266 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
- Affected
- up to 4.9.12.1
- What to do
- Affects up to 4.9.12.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.CVE-2026-65473 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
- Affected
- up to 4.9.12
- What to do
- Affects up to 4.9.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026MCKinney's Politics: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28056 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX MCKinney's Politics mckinney-politics allows PHP Local File Inclusion.This issue affects MCKinney's Politics: from n/a through <= 1.2.8.
- Product
- MCKinney's Politics
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update MCKinney's Politics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Innovio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22403 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Innovio innovio allows PHP Local File Inclusion.This issue affects Innovio: from n/a through <= 1.9.
- Product
- Innovio
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Innovio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Innovio: Authorization Bypass Through User-Controlled KeyCVE-2026-22404 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Innovio: from n/a through <= 1.7.
- Product
- Innovio
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Innovio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Pubzinne: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60060 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Pubzinne pubzinne allows PHP Local File Inclusion.This issue affects Pubzinne: from n/a through <= 1.0.12.
- Product
- Pubzinne
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update Pubzinne to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Wordpress Auto Spinner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46500 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Reflected XSS.This issue affects Wordpress Auto Spinner: from n/a through <= 3.26.0.
- Product
- Wordpress Auto Spinner
- Affected
- up to 3.26.0
- What to do
- Affects up to 3.26.0. Update Wordpress Auto Spinner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Winnex: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32302 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Winnex winnex allows PHP Local File Inclusion.This issue affects Winnex: from n/a through <= 1.3.2.
- Product
- Winnex
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Winnex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Wordpress Auto Spinner: Missing AuthorizationCVE-2025-47534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through <= 3.25.0.
- Product
- Wordpress Auto Spinner
- Affected
- up to 3.25.0
- What to do
- Affects up to 3.25.0. Update Wordpress Auto Spinner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2025WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Arbitrary file deletionCVE-2025-4206 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Affected
- up to 4.1.1.2
- What to do
- Affects up to 4.1.1.2. Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2025Jet Skinner for BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23706 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in milordk Jet Skinner for BuddyPress jet-skinner-for-buddypress allows Reflected XSS.This issue affects Jet Skinner for BuddyPress: from n/a through <= 1.2.5.
- Product
- Jet Skinner for BuddyPress
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Jet Skinner for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Winning Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23865 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressfore Winning Portfolio winning-portfolio allows Stored XSS.This issue affects Winning Portfolio: from n/a through <= 1.1.
- Product
- Winning Portfolio
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Winning Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2025WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Arbitrary file uploadsCVE-2025-0394 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Affected
- up to 3.7.3.5
- What to do
- Affects up to 3.7.3.5. Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2025Pósturinn\'s Shipping with WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11815 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pósturinn\'s Shipping with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the printed_marked and nonprinted_marked parameters in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Pósturinn\'s Shipping with WooCommerce
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Pósturinn\'s Shipping with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 11, 2024Last Viewed Posts by WPBeginner: Sensitive Information ExposureCVE-2024-12294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the 'get_legacy_cookies' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and permalinks of private, password-protected, pending, and draft posts.
- Product
- Last Viewed Posts by WPBeginner
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Last Viewed Posts by WPBeginner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024Utech Spinning Earth: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51839 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech Spinning Earth utech-spinning-earth allows DOM-Based XSS.This issue affects Utech Spinning Earth: from n/a through <= 1.2.
- Product
- Utech Spinning Earth
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Utech Spinning Earth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Last Viewed Posts by WPBeginner: PHP Object InjectionCVE-2024-3070 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input from the LastViewedPosts Cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Last Viewed Posts by WPBeginner
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Last Viewed Posts by WPBeginner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 18, 2024Innovs HR: Does not have CSRF checks in some placesCVE-2024-0858 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
- Product
- Innovs HR
- Fixed in
- 1.0.3.7.1
- What to do
- Update Innovs HR to 1.0.3.7.1 or newer.
Dec 14, 2023Innovs HR – Complete Human Resource Management System for Your Business: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49171 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs Innovs HR – Complete Human Resource Management System for Your Business allows Reflected XSS.This issue affects Innovs HR – Complete Human Resource Management System for Your Business: from n/a through 1.0.3.4.
- Product
- Innovs HR – Complete Human Resource Management System for Your Business
- Affected
- up to 1.0.3.4
- What to do
- Affects up to 1.0.3.4. Update Innovs HR – Complete Human Resource Management System for Your Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 10, 2023WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Fixed in
- 2.7.9.4
- What to do
- Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to 2.7.9.4 or newer.
Mar 23, 2023Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous TypeCVE-2023-23707 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.
- Product
- Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 2, 2020The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.CVE-2019-20204 · WordPress plugins & themes · reported by MITREMedium 5.4
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
- Affected
- up to 1.9.40
- What to do
- Affects up to 1.9.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 20, 2019The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.CVE-2015-9408 · WordPress plugins & themes · reported by MITREMedium 6.5
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
- Product
- xpinner-lite
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update xpinner-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 20, 2019The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.CVE-2015-9407 · WordPress plugins & themes · reported by MITREMedium 6.1
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
- Product
- xpinner-lite
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update xpinner-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.