Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

34 results

Jun 9, 2026jQuery Hover Footnotes: Stored Cross-Site ScriptingCVE-2026-10738 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts.
Product
jQuery Hover Footnotes
Affected
up to 1.4
What to do
Affects up to 1.4. Update jQuery Hover Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2026jQuery Hover Footnotes: Cross-Site Request ForgeryCVE-2026-10553 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the jqFootnotes_options_subpanel function. This makes it possible for unauthenticated attackers to update the plugin's settings with arbitrary values that, because option values such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title are echoed unescaped into frontend page content, can be chained into persistent Cross-Site Scripting affecting all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation of the CSRF vulnerability can be chained into stored Cross-Site Scripting, as the overwritten option values are persisted via update_option() without sanitization and rendered unescaped on the frontend.
Product
jQuery Hover Footnotes
Affected
up to 1.4
What to do
Affects up to 1.4. Update jQuery Hover Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Enable jQuery Migrate Helper: Unauthorized modification of dataCVE-2026-3279 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `downgrade_jquery_version()` function in all versions up to, and including, 1.4.1. This is due to the function only verifying a nonce without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to downgrade the site-wide jQuery version from 3.7.1 to the legacy 1.12.4-wp release, which has knowns security vulnerabilities.
Product
Enable jQuery Migrate Helper
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Enable jQuery Migrate Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026jQuery googleslides: Stored Cross-Site ScriptingCVE-2026-8866 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes (userid, albumid, authkey, imgmax, maxresults, random, caption, albumlink, time, and fadespeed) in the googleslides_handler() function, which interpolates the attribute values directly into single-quoted HTML attributes without using esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
jQuery googleslides
Affected
up to 1.3
What to do
Affects up to 1.3. Update jQuery googleslides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025WP jQuery Pager: SQL InjectionCVE-2025-10575 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_page_imgs() function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP jQuery Pager
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update WP jQuery Pager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 12, 2025jQuery Colorbox: Uses the colorbox libraryCVE-2025-3650 · WordPress plugins & themes · reported by WPScanLow 3.5
The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.
Product
jQuery Colorbox
Affected
up to 4.6.3
What to do
Affects up to 4.6.3. Update jQuery Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 7, 2025WP jQuery DataTable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47605 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty WP jQuery DataTable wp-jquery-datatable allows Stored XSS.This issue affects WP jQuery DataTable: from n/a through <= 4.1.0.
Product
WP jQuery DataTable
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update WP jQuery DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Milat jQuery Automatic Popup: Cross-Site Request Forgery (CSRF)CVE-2025-46514 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in milat Milat jQuery Automatic Popup milat-jquery-automatic-popup allows Stored XSS.This issue affects Milat jQuery Automatic Popup: from n/a through <= 1.3.1.
Product
Milat jQuery Automatic Popup
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Milat jQuery Automatic Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025jQuery Dropdown Menu: Cross-Site Request Forgery (CSRF)CVE-2025-30560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0.
Product
jQuery Dropdown Menu
Affected
up to 3.0
What to do
Affects up to 3.0. Update jQuery Dropdown Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025WP jQuery Persian Datepicker: Cross-Site Request Forgery (CSRF)CVE-2025-28861 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian Datepicker: from n/a through <= 0.1.0.
Product
WP jQuery Persian Datepicker
Affected
up to 0.1.0
What to do
Affects up to 0.1.0. Update WP jQuery Persian Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Responsive jQuery Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer Responsive jQuery Slider responsive-jquery-slider allows Stored XSS.This issue affects Responsive jQuery Slider: from n/a through <= 1.1.1.
Product
Responsive jQuery Slider
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Responsive jQuery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025jQuery TwentyTwenty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22546 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through <= 1.0.
Product
jQuery TwentyTwenty
Affected
up to 1.0
What to do
Affects up to 1.0. Update jQuery TwentyTwenty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP jQuery DataTable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56287 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty WP jQuery DataTable wp-jquery-datatable allows Stored XSS.This issue affects WP jQuery DataTable: from n/a through <= 4.0.1.
Product
WP jQuery DataTable
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP jQuery DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP jQuery DataTable: Stored Cross-Site ScriptingCVE-2024-12499 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP jQuery DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_jdt' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP jQuery DataTable
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP jQuery DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 26, 2024jQuery T(-) Countdown Widget: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37247 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in twinpictures, baden03 jQuery T(-) Countdown Widget allows Stored XSS.This issue affects jQuery T(-) Countdown Widget: from n/a through 2.3.25.
Product
jQuery T(-) Countdown Widget
Affected
up to 2.3.25
What to do
Affects up to 2.3.25. Update jQuery T(-) Countdown Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 7, 2024WP jQuery Lightbox: Stored Cross-Site ScriptingCVE-2024-5425 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP jQuery Lightbox
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update WP jQuery Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 22, 2024jQuery T(-) Countdown Widget: Stored Cross-Site ScriptingCVE-2024-4783 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and including, 2.3.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37247 may be a duplicate of this issue.
Product
jQuery T(-) Countdown Widget
Affected
up to 2.3.25
What to do
Affects up to 2.3.25. Update jQuery T(-) Countdown Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024Quicksand Post Filter jQuery: Missing AuthorizationCVE-2024-24850 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Product
Quicksand Post Filter jQuery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Quicksand Post Filter jQuery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024Quicksand Post Filter jQuery: Cross-Site Request Forgery (CSRF)CVE-2024-24849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Product
Quicksand Post Filter jQuery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Quicksand Post Filter jQuery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Jquery news ticker: Stored Cross-Site ScriptingCVE-2023-5432 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jquery news ticker
Affected
up to 3.1
What to do
Affects up to 3.1. Update Jquery news ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023Jquery accordion slideshow: SQL InjectionCVE-2023-5464 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Jquery accordion slideshow
Affected
up to 8.1
What to do
Affects up to 8.1. Update Jquery accordion slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023Jquery news ticker: SQL InjectionCVE-2023-5430 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Jquery news ticker
Affected
up to 3.0
What to do
Affects up to 3.0. Update Jquery news ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2023JQuery Accordion Menu Widget: Stored Cross-Site ScriptingCVE-2023-4890 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
JQuery Accordion Menu Widget
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update JQuery Accordion Menu Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2023jQuery T(-) Countdown Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0171 · WordPress plugins & themes · reported by WPScanMedium 5.4
The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
jQuery T(-) Countdown Widget
Fixed in
2.3.24
What to do
Update jQuery T(-) Countdown Widget to 2.3.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Jquery Validation For Contact Form 7: Does not have CSRF check in placeCVE-2022-2144 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog options like default_role, users_can_register via a CSRF attack
Product
Jquery Validation For Contact Form 7
Fixed in
5.3
What to do
Update Jquery Validation For Contact Form 7 to 5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021jQuery Reply to Comment: Does not have any CSRF checkCVE-2021-24543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
Product
jQuery Reply to Comment
Affected
up to 1.31
What to do
Affects up to 1.31. Update jQuery Reply to Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021jQuery Tagline Rotator: Reflected Cross-Site ScriptingCVE-2021-34663 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5.
Product
jQuery Tagline Rotator
Affected
up to 0.1.5
What to do
Affects up to 0.1.5. Update jQuery Tagline Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 8, 2020Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions CreaCVE-2014-8739 · WordPress plugins & themes · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Fixed in
1.0.0
What to do
Update the plugin to 1.0.0 or newer.
Full record and what to do →NVD record osvdb.org osvdb.org
Oct 22, 2019The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.CVE-2015-9500 · WordPress plugins & themes · reported by MITREMedium 6.1
The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
Affected
1.3.3 to 1.3.3
What to do
Affects 1.3.3 to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 10, 2019The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1CVE-2015-9479 · WordPress plugins & themes · reported by MITRECritical 9.8
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
Product
ACF-Frontend-Display
Affected
up to 2015-07-03
What to do
Affects up to 2015-07-03. Update ACF-Frontend-Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 26, 2019The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.CVE-2015-9444 · WordPress plugins & themes · reported by MITREMedium 6.1
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
Affected
1.3.0 to 1.3.0
What to do
Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Feb 11, 2018Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.CVE-2018-6891 · WordPress plugins & themes · reported by MITREMedium 6.1
Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.
Fixed in
14.5
What to do
Update the plugin to 14.5 or newer.
Full record and what to do →NVD record wordpress.org gubello.me
Feb 26, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow reCVE-2015-2089 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) csj_width, (3) csj_height, (4) csj_sleep, (5) csj_fade, or (6) upload_image parameter in the thisismyurl_csj.php page to wp-admin/options-general.php.
Product
CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress)
Affected
2.0.5 to 2.0.5
What to do
Affects 2.0.5 to 2.0.5. Update CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Sep 20, 2012Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web scriCVE-2011-5180 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information. NOTE: this has been disputed by a third party.
Product
ZooEffect
What to do
Update ZooEffect to the newest version.
Full record and what to do →NVD record osvdb.org securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.