Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Sep 28, 2026SPS-Suite: Does not sanitise the search query before using it in a SQL queryCVE-2026-93000 · WordPress plugins & themes · reported by WPScanMedium 6.8
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- SPS-Suite
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update SPS-Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025Invelity SPS connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68876 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect invelity-sps-connect allows Reflected XSS.This issue affects Invelity SPS connect: from n/a through <= 1.0.8.
- Product
- Invelity SPS connect
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Invelity SPS connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2025Small Package Quotes – USPS Edition: Deserialization of Untrusted DataCVE-2025-58218 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in enituretechnology Small Package Quotes – USPS Edition small-package-quotes-usps-edition allows Object Injection.This issue affects Small Package Quotes – USPS Edition: from n/a through <= 1.3.9.
- Product
- Small Package Quotes – USPS Edition
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Small Package Quotes – USPS Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2025Small Package Quotes – USPS Edition: SQL InjectionCVE-2024-13533 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Small Package Quotes – USPS Edition
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Small Package Quotes – USPS Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2024USPS Shipping for WooCommerce – Live Rates: Insertion of Sensitive Information into Log FileCVE-2024-32811 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.4.
- Product
- USPS Shipping for WooCommerce – Live Rates
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update USPS Shipping for WooCommerce – Live Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 10, 2024USPS Shipping for WooCommerce – Live Rates: Cross-Site Request Forgery (CSRF)CVE-2024-31943 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.2.
- Product
- USPS Shipping for WooCommerce – Live Rates
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update USPS Shipping for WooCommerce – Live Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.