Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

304 results · page 1 of 7

Oct 14, 2026Responsive Blocks: Does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site ownerCVE-2026-97315 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
Product
Responsive Blocks
Fixed in
2.3.0
What to do
Update Responsive Blocks to 2.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 13, 2026Responsive Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This issue affects Responsive Slider: from n/a through 0.1.9.
Product
Responsive Slider
Affected
up to 0.1.9
What to do
Affects up to 0.1.9. Update Responsive Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Responsive Lightbox & Gallery: Stored Cross-Site ScriptingCVE-2026-103897 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's 'Comments' lightbox setting to be enabled (disabled by default), a moderator to approve the injected comment, and a site visitor to click the affected image to open the lightbox.
Product
Responsive Lightbox & Gallery
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update Responsive Lightbox & Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2026Responsive Plus – Elementor Templates & Starter Sites: Stored Cross-Site ScriptingCVE-2026-15795 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Plus – Elementor Templates & Starter Sites
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update Responsive Plus – Elementor Templates & Starter Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2026Tabs Responsive: Does not sanitize the content of WooCommerce product tabs before storing and rendering itCVE-2026-13718 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.
Product
Tabs Responsive
Affected
up to 2.5
What to do
Affects up to 2.5. Update Tabs Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 30, 2026Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.CVE-2026-94122 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 1, 2026Photo Gallery by Ays – Responsive Image Gallery: Generic SQL InjectionCVE-2026-76006 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability exists across two execution paths — $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories() — enabling both blind and UNION-based exfiltration techniques.
Product
Photo Gallery by Ays – Responsive Image Gallery
Affected
up to 6.8.2
What to do
Affects up to 6.8.2. Update Photo Gallery by Ays – Responsive Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2026Wp Responsive Thumbnail Slider: Reflected Cross-Site ScriptingCVE-2026-18344 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET['id'] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Product
Wp Responsive Thumbnail Slider
What to do
Update Wp Responsive Thumbnail Slider to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 29, 2026Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …: Authentication BypassCVE-2026-18072 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.
Product
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …
What to do
Update Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026WP Support Plus Responsive Ticket System: Does not sign or verify its guest-session cookieCVE-2026-11875 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.
Product
WP Support Plus Responsive Ticket System
Affected
up to 9.1.2
What to do
Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 30, 2026WP Support Plus Responsive Ticket System: Does not sanitize user-supplied array keys before using them in a SQL statementCVE-2026-11590 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
Product
WP Support Plus Responsive Ticket System
Affected
up to 9.1.2
What to do
Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 30, 2026WP Support Plus Responsive Ticket System: Does not properly validate uploaded filesCVE-2026-11589 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.
Product
WP Support Plus Responsive Ticket System
Affected
up to 9.1.2
What to do
Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.CVE-2026-56041 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.CVE-2026-39465 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.
Affected
up to 3.106.0
What to do
Affects up to 3.106.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 11, 2026WP Logo Showcase Responsive Slider and Carousel: Authorization bypass through User-Controlled keyCVE-2023-40200 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Logo Showcase Responsive Slider and Carousel: from n/a through 3.6.
Product
WP Logo Showcase Responsive Slider and Carousel
Affected
up to 3.6
What to do
Affects up to 3.6. Update WP Logo Showcase Responsive Slider and Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Responsive Video Embedder: Stored Cross-Site ScriptingCVE-2026-8877 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Video Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rem_video' shortcode in versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes (notably 'id' and 'list') in the video_shortcode() function, which are concatenated directly into an HTML iframe's src attribute without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Video Embedder
Affected
up to 0.1
What to do
Affects up to 0.1. Update Responsive Video Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Responsive Check: Stored Cross-Site ScriptingCVE-2026-8844 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping on the 'url' (and 'button') shortcode attributes in the rspc_check_shortcode() function, which are echoed directly into iframe src attributes without esc_attr() or esc_url(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Check
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update Responsive Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2026Ditty – Responsive News Tickers, Sliders, and Lists: Authorization bypassCVE-2026-9011 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the full item content of non-public Dittys — including drafts, pending, scheduled, and disabled entries — by enumerating integer post IDs against the ditty_init AJAX endpoint. Unlike the non-AJAX init() counterpart, init_ajax() does not verify that the requested Ditty has a 'publish' post status before loading and returning its items, allowing content that administrators explicitly withheld from public view to be extracted.
Product
Ditty – Responsive News Tickers, Sliders, and Lists
Affected
up to 3.1.65
What to do
Affects up to 3.1.65. Update Ditty – Responsive News Tickers, Sliders, and Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2026Slider by Soliloquy – Responsive Image Slider for: Sensitive Information ExposureCVE-2026-7636 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Slider by Soliloquy – Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 via the map_meta_cap. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract draft slider metadata including unpublished media URLs, captions, and slider configuration authored by administrators or editors.
Product
Slider by Soliloquy – Responsive Image Slider for
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Slider by Soliloquy – Responsive Image Slider for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 22, 2026WP Responsive Popup + Optin: Cross-Site Request ForgeryCVE-2026-4131 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Responsive Popup + Optin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.4. This is due to the settings form on the admin page (wpo_admin_page.php) lacking nonce generation (wp_nonce_field) and verification (wp_verify_nonce/check_admin_referer). This makes it possible for unauthenticated attackers to update all plugin settings including the 'wpo_image_url' parameter via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Product
WP Responsive Popup + Optin
Affected
up to 1.4
What to do
Affects up to 1.4. Update WP Responsive Popup + Optin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 21, 2026Responsive Slider by MetaSlider: Deserialization of Untrusted DataCVE-2026-39467 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.
Product
Responsive Slider by MetaSlider
Affected
up to 3.106.0
What to do
Affects up to 3.106.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 21, 2026Responsive Blocks – Page Builder for Blocks & Patterns: Unauthorized accessCVE-2026-6703 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global site-wide plugin configuration options, including toggling custom CSS, disabling blocks, changing layout defaults such as content width, container padding, and container gap, and altering auto-block-recovery behavior.
Product
Responsive Blocks – Page Builder for Blocks & Patterns
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Responsive Blocks – Page Builder for Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 20, 2026Responsive Blocks – Page Builder for Blocks & Patterns: Unauthenticated Open Email RelayCVE-2026-6675 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Email Relay in all versions up to, and including, 2.2.0. This is due to insufficient authorization checks and missing server-side validation of the recipient email address supplied via a public REST API route. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient of their choosing through the affected WordPress site's mail server, effectively turning the site into an open mail relay.
Product
Responsive Blocks – Page Builder for Blocks & Patterns
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Responsive Blocks – Page Builder for Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2026Responsive Plus: Is vulnerable to arbitrary shortcode execution due to the software allowing unauthenticated users to execute the update_responsive_woo_free_shipping_left_shortcode AJAX action that does not properly valiCVE-2025-15488 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Responsive Plus WordPress plugin before 3.4.3 is vulnerable to arbitrary shortcode execution due to the software allowing unauthenticated users to execute the update_responsive_woo_free_shipping_left_shortcode AJAX action that does not properly validate the content_rech_data parameter before processing it as a shortcode.
Product
Responsive Plus
Fixed in
3.4.3
What to do
Update Responsive Plus to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Mar 13, 2026Responsive Blocks: Missing AuthorizationCVE-2026-32543 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Blocks: from n/a through <= 2.2.0.
Product
Responsive Blocks
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Responsive Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2026Responsive Contact Form Builder & Lead Generation: Stored Cross-Site ScriptingCVE-2026-1454 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive wp_kses() filter at output time that allows onclick attributes on anchor tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the lead entries in the WordPress dashboard.
Product
Responsive Contact Form Builder & Lead Generation
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Responsive Posts Carousel Pro: Missing AuthorizationCVE-2026-27361 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.
Product
Responsive Posts Carousel Pro
Affected
up to 15.1
What to do
Affects up to 15.1. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2026WP Responsive Images: Path TraversalCVE-2026-1557 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
WP Responsive Images
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Responsive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2026Responsive Lightbox & Gallery: Server-Side Request ForgeryCVE-2026-2479 · WordPress plugins & themes · reported by WordfenceMedium 5
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to the use of `strpos()` for substring-based hostname validation instead of strict host comparison in the `ajax_upload_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.
Product
Responsive Lightbox & Gallery
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Responsive Lightbox & Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 24, 2026Responsive Lightbox & Gallery: Is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious linkCVE-2025-15386 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.
Product
Responsive Lightbox & Gallery
Fixed in
2.6.1
What to do
Update Responsive Lightbox & Gallery to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Feb 20, 2026Slider Responsive Slideshow – Image slider, Gallery slideshow: Deserialization of Untrusted DataCVE-2026-22346 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow slider-responsive-slideshow allows Object Injection.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: from n/a through <= 1.5.4.
Product
Slider Responsive Slideshow – Image slider, Gallery slideshow
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Slider Responsive Slideshow – Image slider, Gallery slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: Deserialization of Untrusted DataCVE-2026-22345 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery new-image-gallery allows Object Injection.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through <= 1.6.0.
Product
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026eDS Responsive Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68845 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Reflected XSS.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
Product
eDS Responsive Menu
Affected
up to 1.2
What to do
Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 11, 2026WDES Responsive Popup: Stored Cross-Site ScriptingCVE-2026-1804 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WDES Responsive Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdes-popup-title' shortcode in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WDES Responsive Popup
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update WDES Responsive Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026Responsive Header: Stored Cross-Site ScriptingCVE-2026-1300 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Responsive Header plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple plugin settings parameters in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Responsive Header
Affected
up to 1.0
What to do
Affects up to 1.0. Update Responsive Header to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Jan 22, 2026Magic Responsive Slider and Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49043 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic_carousel allows Reflected XSS.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through <= 1.6.
Product
Magic Responsive Slider and Carousel
Affected
up to 1.6
What to do
Affects up to 1.6. Update Magic Responsive Slider and Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 14, 2026Responsive Accordion Slider: Unauthorized modification of dataCVE-2026-0635 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordion_silder_save_images' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify any slider's image metadata including titles, descriptions, alt text, and links.
Product
Responsive Accordion Slider
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Responsive Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2026Famous - Responsive Image And Video Grid Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin famous_grid_image_and_video_gallery allows Reflected XSS.This issue affects Famous - Responsive Image And Video Grid Gallery WordPress Plugin: from n/a through <= 1.4.
Product
Famous - Responsive Image And Video Grid Gallery
Affected
up to 1.4
What to do
Affects up to 1.4. Update Famous - Responsive Image And Video Grid Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026Responsive Pricing Table: Stored Cross-Site ScriptingCVE-2025-15058 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Pricing Table
Affected
up to 5.1.12
What to do
Affects up to 5.1.12. Update Responsive Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 7, 2026Responsive Pricing Table: Stored Cross-Site ScriptingCVE-2025-13418 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Pricing Table
Affected
up to 5.1.12
What to do
Affects up to 5.1.12. Update Responsive Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 6, 2026Responsive Addons for Elementor: Missing AuthorizationCVE-2025-69363 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Addons for Elementor: from n/a through <= 2.0.8.
Product
Responsive Addons for Elementor
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Responsive Block Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62135 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in landwire Responsive Block Control responsive-block-control allows DOM-Based XSS.This issue affects Responsive Block Control: from n/a through <= 1.3.0.
Product
Responsive Block Control
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Responsive Block Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025Responsive Posts Carousel Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68996 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.
Product
Responsive Posts Carousel Pro
Affected
up to 15.1
What to do
Affects up to 15.1. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Google AdSense for Responsive Design – GARD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67632 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Plugin Factory Google AdSense for Responsive Design – GARD google-adsense-for-responsive-design-gard allows DOM-Based XSS.This issue affects Google AdSense for Responsive Design – GARD: from n/a through <= 2.23.
Product
Google AdSense for Responsive Design – GARD
Affected
up to 2.23
What to do
Affects up to 2.23. Update Google AdSense for Responsive Design – GARD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 23, 2025Responsive Posts Carousel Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68548 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Stored XSS.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.2.
Product
Responsive Posts Carousel Pro
Affected
up to 15.2
What to do
Affects up to 15.2. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 19, 2025Responsive and Swipe slider: Stored Cross-Site ScriptingCVE-2025-14721 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Responsive and Swipe slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rsSlider shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive and Swipe slider
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Responsive and Swipe slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025Image Slider by Ays- Responsive Slider and Carousel: Cross-Site Request ForgeryCVE-2025-14454 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated attackers to delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Image Slider by Ays- Responsive Slider and Carousel
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Image Slider by Ays- Responsive Slider and Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2025Responsive Lightbox & Gallery: Server-Side Request ForgeryCVE-2025-12359 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' function. This is due to insufficient validation of user-supplied URLs when determining image dimensions for gallery items. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Product
Responsive Lightbox & Gallery
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Responsive Lightbox & Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Slippy Slider – Responsive Touch Navigation Slider: Stored Cross-Site ScriptingCVE-2025-11874 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Slippy Slider – Responsive Touch Navigation Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slippy-slider' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slippy Slider – Responsive Touch Navigation Slider
Affected
up to 2.0
What to do
Affects up to 2.0. Update Slippy Slider – Responsive Touch Navigation Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 6, 2025Responsive Sidebar: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60073 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Responsive Sidebar responsive-sidebar allows PHP Local File Inclusion.This issue affects Responsive Sidebar: from n/a through <= 1.2.2.
Product
Responsive Sidebar
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Responsive Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.