Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Oct 25, 2025Open Source Genesis Framework: Stored Cross-Site ScriptingCVE-2025-10737 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Open Source Genesis Framework theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Open Source Genesis Framework
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update Open Source Genesis Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordstudiopress.github.iowordfence.com
Jun 3, 2025Bit File Manager – 100% Free & Open Source File Manager and Code Editor for: Stored Cross-Site ScriptingCVE-2025-1725 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Bit File Manager – 100% Free & Open Source File Manager and Code Editor for
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Bit File Manager – 100% Free & Open Source File Manager and Code Editor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 5, 2024Bit File Manager – 100% Free & Open Source File Manager and Code Editor for: Limited JavaScript File UploadCVE-2024-8743 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
- Product
- Bit File Manager – 100% Free & Open Source File Manager and Code Editor for
- Affected
- up to 6.5.7
- What to do
- Affects up to 6.5.7. Update Bit File Manager – 100% Free & Open Source File Manager and Code Editor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2024Bit File Manager – 100% Free & Open Source File Manager and Code Editor for: Arbitrary file uploadsCVE-2024-7770 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 6.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted upload permissions by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Bit File Manager – 100% Free & Open Source File Manager and Code Editor for
- Affected
- up to 6.5.5
- What to do
- Affects up to 6.5.5. Update Bit File Manager – 100% Free & Open Source File Manager and Code Editor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2023File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: Deserialization of Untrusted DataCVE-2022-47599 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.
- Product
- File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager
- Affected
- up to 5.2.7
- What to do
- Affects up to 5.2.7. Update File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 26, 2021Woocommerce is an open source eCommerce plugin for WordPress.CVE-2021-32790 · WordPress plugins & themes · reported by GitHubMedium 4.9
Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comwoocommerce.com
Apr 15, 2021Wordpress is an open source CMS.CVE-2021-29450 · WordPress plugins & themes · reported by GitHubMedium 6.5
Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comlists.debian.org
Apr 15, 2021Wordpress is an open source CMS.CVE-2021-29447 · WordPress plugins & themes · reported by GitHubHigh 7.1
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 26, 2021BuddyPress is an open source WordPress plugin to build a community site.CVE-2021-21389 · WordPress plugins & themes · reported by GitHubHigh 8.1
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.
- Fixed in
- 7.2.1
- What to do
- Update the plugin to 7.2.1 or newer.
Full record and what to do →NVD recordbuddypress.orgcodex.buddypress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.