Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

115 results · page 1 of 3

Oct 7, 2026MPG: Does not properly validate the structure of imported project data before using it in a database queryCVE-2026-104953 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
Product
MPG
Fixed in
4.2.3
What to do
Update MPG to 4.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.CVE-2026-97281 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2026WP-CRM System – Manage Clients and Projects: Sensitive Information ExposureCVE-2026-9004 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.
Product
WP-CRM System – Manage Clients and Projects
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update WP-CRM System – Manage Clients and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2026Zephyr Project Manager: Stored Cross-Site ScriptingCVE-2026-76931 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can only be exploited when the 'Directly link to project' plugin setting is disabled.
Product
Zephyr Project Manager
Affected
up to 3.3.205
What to do
Affects up to 3.3.205. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2026Project Manager: Does not check that the user whose activity is being requested is the one making the request in one of its REST API routesCVE-2026-74930 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
Product
Project Manager
Fixed in
4.0.7
What to do
Update Project Manager to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Project Manager: Does not restrict several of its REST API routes to the projects a user belongs toCVE-2026-74929 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.
Product
Project Manager
Fixed in
4.0.7
What to do
Update Project Manager to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Project Manager: Does not have any authorisation check on its import routesCVE-2026-74928 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.
Product
Project Manager
Fixed in
4.0.7
What to do
Update Project Manager to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026WP Project Manager Pro: SQL InjectionCVE-2026-78470 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Project Manager Pro
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP Project Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wedevs.com wordfence.com
Aug 24, 2026Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.CVE-2026-78262 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.CVE-2026-32478 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 28, 2026Taskbuilder – Project Management & Task Management Tool With Kanban Board: SQL InjectionCVE-2026-15267 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query — the value is re-read at line 144 using only sanitize_text_field() (overwriting the earlier absint() result), then concatenated into the SQL WHERE clause as an unquoted numeric operand using only esc_sql(), which does not protect against injection in that context, and finally string-interpolated into the $wpdb->prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Taskbuilder – Project Management & Task Management Tool With Kanban Board
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Project Management, Bug and Issue Tracking: Does not sanitise and escape user supplied input before using it in a SQL queryCVE-2026-12877 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.
Product
Project Management, Bug and Issue Tracking
Fixed in
5.1.0
What to do
Update Project Management, Bug and Issue Tracking to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 1, 2026Taskbuilder – Project Management & Task Management Tool With Kanban Board: Generic SQL InjectionCVE-2026-12110 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'task_search' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The wppm_get_task_list AJAX handler performs no capability check and no nonce verification, meaning any authenticated user including those with Subscriber-level access can invoke it directly.
Product
Taskbuilder – Project Management & Task Management Tool With Kanban Board
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026Taskbuilder – Project Management & Task Management Tool With Kanban Board: Generic SQL InjectionCVE-2026-12090 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'wppm_proj_filter' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. No nonce verification is performed on the wp_ajax_wppm_view_project_tasks handler, meaning any authenticated session — including subscriber-level — can reach the vulnerable code path without any additional preconditions.
Product
Taskbuilder – Project Management & Task Management Tool With Kanban Board
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 15, 2026Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.CVE-2025-59133 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.
Affected
up to 5.1.25.2
What to do
Affects up to 5.1.25.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 3, 2026SP Project & Document Manager: Unauthorized accessCVE-2026-10737 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php.
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Taskbuilder – Project Management & Task Management Tool With Kanban Board: Time-based blind SQL InjectionCVE-2026-6225 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'project_search' parameter in all versions up to, and including, 5.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Taskbuilder – Project Management & Task Management Tool With Kanban Board
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2026WPNakama – Team and multi-Client Collaboration, Editorial and Project Management: SQL InjectionCVE-2026-2495 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the '/wp-json/WPNakama/v1/boards' REST API endpoint in all versions up to, and including, 0.6.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPNakama – Team and multi-Client Collaboration, Editorial and Project Management
Affected
up to 0.6.5
What to do
Affects up to 0.6.5. Update WPNakama – Team and multi-Client Collaboration, Editorial and Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026Taskbuilder – WordPress Project Management & Task Management: Authorization bypassCVE-2026-1640 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.2. This is due to missing authorization checks on the project and task comment submission functions (AJAX actions: wppm_submit_proj_comment and wppm_submit_task_comment). This makes it possible for authenticated attackers, with subscriber-level access and above, to create comments on any project or task (including private projects they cannot view or are not assigned to), and inject arbitrary HTML and CSS via the insufficiently sanitized comment_body parameter.
Product
Taskbuilder – WordPress Project Management & Task Management
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Taskbuilder – WordPress Project Management & Task Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026Taskbuilder – WordPress Project Management & Task Management: Time-based blind SQL InjectionCVE-2026-1639 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort_by' parameters in all versions up to, and including, 5.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Taskbuilder – WordPress Project Management & Task Management
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Taskbuilder – WordPress Project Management & Task Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 17, 2026SP Project & Document Manager: Missing AuthorizationCVE-2024-31118 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Smartypants SP Project & Document Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SP Project & Document Manager: from n/a through 4.70.
Product
SP Project & Document Manager
Affected
up to 4.70
What to do
Affects up to 4.70. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Synergy Project Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68898 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cjjparadoxmax Synergy Project Manager synergy-project-manager allows Stored XSS.This issue affects Synergy Project Manager: from n/a through <= 1.5.
Product
Synergy Project Manager
Affected
up to 1.5
What to do
Affects up to 1.5. Update Synergy Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 13, 2026Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries.CVE-2023-54333 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted POST requests with malicious SQL payloads to retrieve and potentially steal entire database contents.
Product
Social-Share-Buttons
What to do
Update Social-Share-Buttons to the newest version.
Full record and what to do →NVD record github.com supsystic.com
Dec 31, 2025Zielke Design Project Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23705 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry Zielke Zielke Design Project Gallery zielke-design-project-gallery allows Reflected XSS.This issue affects Zielke Design Project Gallery: from n/a through <= 2.5.0.
Product
Zielke Design Project Gallery
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Zielke Design Project Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 29, 2025WP Project Manager: Insertion of Sensitive Information Into Sent DataCVE-2025-68040 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 3.0.1.
Product
WP Project Manager
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 17, 2025Zephyr Project Manager: Directory TraversalCVE-2025-12496 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the `file` parameter. This makes it possible for authenticated attackers, with Custom-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. On a servers that have `allow_url_fopen` enabled, this issue allows for Server-Side Request Forgery
Product
Zephyr Project Manager
Affected
up to 3.3.203
What to do
Affects up to 3.3.203. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart: Privilege escalationCVE-2025-12963 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin
Product
LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart
Affected
up to 1.2.29
What to do
Affects up to 1.2.29. Update LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 9, 2025Portfolio and Projects: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.
Product
Portfolio and Projects
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 5, 2025Projectopia – WordPress Project Management: Unauthorized modification of dataCVE-2025-12876 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pto_delete_file AJAX action in all versions up to, and including, 5.1.19. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
Product
Projectopia – WordPress Project Management
Affected
up to 5.1.19
What to do
Affects up to 5.1.19. Update Projectopia – WordPress Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025ProjectList: Arbitrary file uploadsCVE-2025-13376 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
ProjectList
Affected
up to 0.3.0
What to do
Affects up to 0.3.0. Update ProjectList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025ProjectList: Time-based SQL InjectionCVE-2025-13370 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
ProjectList
Affected
up to 0.3.0
What to do
Affects up to 0.3.0. Update ProjectList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record it.wordpress.org plugins.trac.wordpress.org
Nov 18, 2025Project Honey Pot Spam Trap: Cross-Site Request ForgeryCVE-2025-12406 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Project Honey Pot Spam Trap
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Project Honey Pot Spam Trap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2025Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager: Time-based SQL InjectionCVE-2025-8994 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘completed_at_operator’ parameter in all versions up to, and including, 2.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager
Affected
up to 2.6.26
What to do
Affects up to 2.6.26. Update Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025The Total Book Project: Insecure Direct Object ReferenceCVE-2025-12126 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform several actions like moving/deleting/creating chapters in books that do not belong to them.
Product
The Total Book Project
Affected
up to 1.0
What to do
Affects up to 1.0. Update The Total Book Project to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 26, 2025Zephyr Project Manager: Stored Cross-Site ScriptingCVE-2025-10490 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Zephyr Project Manager
Affected
up to 3.3.202
What to do
Affects up to 3.3.202. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2025WP Project Manager: Use of Hard-coded CredentialsCVE-2025-58269 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.
Product
WP Project Manager
Affected
up to 2.6.25
What to do
Affects up to 2.6.25. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Zephyr Project Manager: Missing AuthorizationCVE-2025-54714 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.201.
Product
Zephyr Project Manager
Affected
up to 3.3.201
What to do
Affects up to 3.3.201. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Project Cost Calculator: Missing AuthorizationCVE-2025-52775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Project Cost Calculator: from n/a through <= 1.0.0.
Product
Project Cost Calculator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Project Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 28, 2025PT Project Notebooks: Privilege EscalationCVE-2025-5304 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in versions 1.0.0 through 1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
Product
PT Project Notebooks
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update PT Project Notebooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2025UpStream: a Project Management Plugin for: Missing AuthorizationCVE-2025-49974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through <= 2.1.1.
Product
UpStream: a Project Management Plugin for
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update UpStream: a Project Management Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025wProject: Incorrect Privilege AssignmentCVE-2025-39366 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0.
Product
wProject
Fixed in
5.8.0
What to do
Update wProject to 5.8.0 or newer.
Full record and what to do →NVD record patchstack.com
May 19, 2025wProject: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39365 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affects wProject: from n/a before 5.8.0.
Product
wProject
Fixed in
5.8.0
What to do
Update wProject to 5.8.0 or newer.
Full record and what to do →NVD record patchstack.com
May 19, 2025wProject: Missing AuthorizationCVE-2025-39350 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0.
Product
wProject
Fixed in
5.8.0
What to do
Update wProject to 5.8.0 or newer.
Full record and what to do →NVD record patchstack.com
May 19, 2025Projectopia: Missing AuthorizationCVE-2025-48257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through <= 5.1.17.
Product
Projectopia
Affected
up to 5.1.17
What to do
Affects up to 5.1.17. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 1, 2025Projectopia – WordPress Project Management: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-3952 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'pto_remove_logo' function in all versions up to, and including, 5.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
Projectopia – WordPress Project Management
Affected
up to 5.1.16
What to do
Affects up to 5.1.16. Update Projectopia – WordPress Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2025Projectopia: Incorrect Privilege AssignmentCVE-2025-32648 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Projectopia Projectopia projectopia-core allows Privilege Escalation.This issue affects Projectopia: from n/a through <= 5.1.24.
Product
Projectopia
Affected
up to 5.1.24
What to do
Affects up to 5.1.24. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Zephyr Project Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through <= 3.3.101.
Product
Zephyr Project Manager
Affected
up to 3.3.101
What to do
Affects up to 3.3.101. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Zephyr Project Manager: Missing AuthorizationCVE-2025-39552 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.200.
Product
Zephyr Project Manager
Affected
up to 3.3.200
What to do
Affects up to 3.3.200. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025WP Project Manager: Stored Cross-Site ScriptingCVE-2025-2541 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Project Manager
Affected
up to 2.6.22
What to do
Affects up to 2.6.22. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 10, 2025Processing Projects: Unrestricted Upload of File with Dangerous TypeCVE-2025-32206 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects processing-projects allows Upload a Web Shell to a Web Server.This issue affects Processing Projects: from n/a through <= 1.0.2.
Product
Processing Projects
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Processing Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.