Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

542new WordPress flaws this week

391,181entries in the database

10 results

Apr 1, 2025WP Multistore Locator: Cross-Site Request Forgery (CSRF)CVE-2025-31888 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Cross Site Request Forgery.This issue affects WP Multistore Locator: from n/a through <= 2.5.2.
Product
WP Multistore Locator
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025WP Multistore Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28898 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.2.
Product
WP Multistore Locator
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025WP Multistore Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26974 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Blind SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.1.
Product
WP Multistore Locator
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 27, 2025WP Multistore Locator: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24680 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Reflected XSS.This issue affects WP Multistore Locator: from n/a through <= 2.4.7.
Product
WP Multistore Locator
Affected
up to 2.4.7
What to do
Affects up to 2.4.7. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2024Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop before version 1.6.6, a guest cCVE-2024-24311 · Other software · Lineagrafica · reported by MITREHigh 7.5
Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop before version 1.6.6, a guest can download personal information without restriction.
Product
Multilingual And Multistore Sitemap Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Jan 28, 2022H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID.CVE-2021-46448 · Other software · Hhg-multistore · reported by MITRECritical 9.8
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID.
Product
Multistore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com hhg-multistore.com
Jan 28, 2022A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload CVE-2021-46447 · Other software · Hhg-multistore · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the State parameter under the Address Book module.
Product
Multistore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com hhg-multistore.com
Jan 28, 2022H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID.CVE-2021-46446 · Other software · Hhg-multistore · reported by MITRECritical 9.8
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID.
Product
Multistore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com hhg-multistore.com
Jan 28, 2022H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id.CVE-2021-46445 · Other software · Hhg-multistore · reported by MITRECritical 9.8
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id.
Product
Multistore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com hhg-multistore.com
Jan 28, 2022H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID.CVE-2021-46444 · Other software · Hhg-multistore · reported by MITRECritical 9.8
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID.
Product
Multistore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com hhg-multistore.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.