Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.CVE-2026-57671 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2026Perfmatters: Directory TraversalCVE-2026-13251 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the Local Google Fonts feature to be enabled (disabled by default), pretty permalinks to be active, and RSS feed links to remain enabled in the plugin settings.
- Product
- Perfmatters
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Perfmatters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordperfmatters.ioplugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.CVE-2026-56047 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.
- What to do
- Update the plugin to the newest version.
Apr 9, 2026Perfmatters: Arbitrary file overwriteCVE-2026-4351 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the `PMCS::action_handler()` method processing the bulk action `activate`/`deactivate` handlers without any authorization check or nonce verification. The `$_GET['snippets'][]` values are passed unsanitized to `Snippet::activate()`/`Snippet::deactivate()` which call `Snippet::update()` then `file_put_contents()` with the traversed path. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite arbitrary files on the server with a fixed PHP docblock content, potentially causing denial of service by corrupting critical files like `.htaccess` or `index.php`.
- Product
- Perfmatters
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update Perfmatters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordperfmatters.iowordfence.com
Apr 3, 2026Perfmatters: Arbitrary file deletionCVE-2026-4350 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to `unlink()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server by using `../` path traversal sequences, including `wp-config.php` which would force WordPress into the installation wizard and allow full site takeover.
- Product
- Perfmatters
- Affected
- up to 2.5.9.1
- What to do
- Affects up to 2.5.9.1. Update Perfmatters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordperfmatters.iowordfence.com
Mar 20, 2026CM Custom Reports – Flexible reporting to track what matters most: Stored Cross-Site ScriptingCVE-2026-2432 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- CM Custom Reports – Flexible reporting to track what matters most
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update CM Custom Reports – Flexible reporting to track what matters most to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2025Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters: Authorization bypassCVE-2025-13309 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers with subscriber-level access and above to modify the plugin’s global accessibility settings.
- Product
- Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025Developer Formatter: Stored Cross-Site ScriptingCVE-2025-5699 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Developer Formatter
- Affected
- up to 2015.0.2.1
- What to do
- Affects up to 2015.0.2.1. Update Developer Formatter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Urdu Formatter – Shamil: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22531 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M Bilal M Urdu Formatter – Shamil urdu-formatter-shamil allows Stored XSS.This issue affects Urdu Formatter – Shamil: from n/a through <= 0.1.
- Product
- Urdu Formatter – Shamil
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Urdu Formatter – Shamil to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2024WP Matterport Shortcode: Cross-Site Request Forgery (CSRF)CVE-2024-32109 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Julien Berthelot / MPEmbed.Com WP Matterport Shortcode allows Cross Site Request Forgery.This issue affects WP Matterport Shortcode: from n/a through 2.1.9.
- Product
- WP Matterport Shortcode
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update WP Matterport Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 29, 2024Perfmatters: Missing AuthorizationCVE-2023-47874 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Perfmatters.This issue affects Perfmatters: from n/a through 2.1.6.
- Product
- Perfmatters
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Perfmatters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Perfmatters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47877 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Stored XSS.This issue affects Perfmatters: from n/a before 2.2.0.
- Product
- Perfmatters
- Fixed in
- 2.2.0
- What to do
- Update Perfmatters to 2.2.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Perfmatters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47876 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Reflected XSS.This issue affects Perfmatters: from n/a through 2.1.6.
- Product
- Perfmatters
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Perfmatters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Perfmatters: Cross-Site Request Forgery (CSRF)CVE-2023-47875 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Perfmatters allows Cross Site Request Forgery.This issue affects Perfmatters: from n/a through 2.1.6.
- Product
- Perfmatters
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Perfmatters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 16, 2023WP Matterport Shortcode: Does not escape the PHP_SELF server variableCVE-2023-4290 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.7
- What to do
- Update WP Matterport Shortcode to 2.1.7 or newer.
Oct 16, 2023WP Matterport Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4289 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.8
- What to do
- Update WP Matterport Shortcode to 2.1.8 or newer.
Aug 16, 2021Plugmatter Pricing Table Lite: Reflected Cross-Site ScriptingCVE-2021-34659 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `email` parameter in the ~/license.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.32.
- Product
- Plugmatter Pricing Table Lite
- Affected
- up to 1.0.32
- What to do
- Affects up to 1.0.32. Update Plugmatter Pricing Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameCVE-2015-9451 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
- Product
- plugmatter-optin-feature-box-lite
- Fixed in
- 2.0.14
- What to do
- Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Oct 7, 2019The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.CVE-2015-9450 · WordPress plugins & themes · reported by MITRECritical 9.8
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
- Product
- plugmatter-optin-feature-box-lite
- Fixed in
- 2.0.14
- What to do
- Update plugmatter-optin-feature-box-lite to 2.0.14 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.