Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
36 results
Feb 19, 2026NewsBlogger: Cross-Site Request ForgeryCVE-2025-12821 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This is due to a reverted fix of CVE-2025-1305.
- Product
- NewsBlogger
- What to do
- Update NewsBlogger to the newest version.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Jul 18, 2025A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered.CVE-2025-50126 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 5.3
A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web script or HTML via the jform[tags_text] parameter.
- Product
- RSBlog! component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered.CVE-2025-27754 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 6.5
A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered. The vulnerability allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when other users view the affected content.
- Product
- RSBlog component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025NewsBlogger: Cross-Site Request ForgeryCVE-2025-1305 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- NewsBlogger
- Affected
- up to 0.2.5.4
- What to do
- Affects up to 0.2.5.4. Update NewsBlogger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
May 1, 2025NewsBlogger: Arbitrary file uploadsCVE-2025-1304 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- NewsBlogger
- Affected
- up to 0.2.5.1
- What to do
- Affects up to 0.2.5.1. Update NewsBlogger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Mar 20, 2025FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victiCVE-2024-9847 · Other software · flatpressblog · reported by security@huntr.devHigh 8
FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress CMS server to perform the desired action on behalf of the victim user. Since the request is authenticated, the server will process it as if it were initiated by the legitimate user, effectively allowing the attacker to perform unauthorized actions. This vulnerability is fixed in version 1.4.dev.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payloadCVE-2024-9699 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by other users. The issue is fixed in version 1.4.dev.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3.CVE-2024-4023 · Other software · flatpressblog · reported by security@huntr.devHigh 8.1
A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a `.xsig` extension and directly accesses this file, the server responds with a Content-type of application/octet-stream, leading to the file being processed as an HTML file. This allows an attacker to execute arbitrary JavaScript code, which can be used to steal user cookies, perform HTTP requests, and access content of the same origin.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2023The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.CVE-2023-52264 · Other software · Thirtybees · reported by MITREMedium 6.1
The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.
- Product
- Bees Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023SQL injection vulnerability found in PrestaShop themevolty v.4.0.8 and before allow a remote attacker to gain privileges via the tvcmsblog, tvcmsvideotab, tvcmsCVE-2023-27846 · Other software · Themevolty · reported by MITRECritical 9.8
SQL injection vulnerability found in PrestaShop themevolty v.4.0.8 and before allow a remote attacker to gain privileges via the tvcmsblog, tvcmsvideotab, tvcmswishlist, tvcmsbrandlist, tvcmscategorychainslider, tvcmscategoryproduct, tvcmscategoryslider, tvcmspaymenticon, tvcmstestimonial components.
- Product
- Theme Volty CMS Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Aug 28, 2023Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.CVE-2023-39650 · Other software · Themevolty · reported by MITRECritical 9.8
Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.
- Product
- Theme Volty CMS Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgthemevolty.com
Mar 23, 2023PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.CVE-2023-27034 · Other software · Joommasters · reported by MITRECritical 9.8
PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.
- Product
- JMS Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfriends-of-presta.github.iofriends-of-presta.github.io
Mar 1, 2023Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1148 · Other software · flatpressblog · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1147 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1146 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1107 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1106 · Other software · flatpressblog · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1105 · Other software · flatpressblog · reported by security@huntr.devHigh 8.1
External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-1104 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-0947 · Other software · flatpressblog · reported by security@huntr.devCritical 9.8
Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2022-4605 · Other software · flatpressblog · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2022PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2022-4606 · Other software · flatpressblog · reported by security@huntr.devCritical 9.8
PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.
- Product
- flatpressblog/flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2014Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remoCVE-2014-7292 · Other software · Newtelligence · reported by MITREMedium 5.8
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.
- Product
- Dasblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 23, 2010Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unCVE-2010-1491 · Other software · Mms.pipp · reported by MITREMedium 5
Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
- Product
- COM Mmsblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Dec 17, 2008SQL injection vulnerability in blog.asp in ParsBlogger (Pb) allows remote attackers to execute arbitrary SQL commands via the wr parameter.CVE-2008-5637 · Other software · Parsblogger · reported by MITREHigh 7.5
SQL injection vulnerability in blog.asp in ParsBlogger (Pb) allows remote attackers to execute arbitrary SQL commands via the wr parameter.
- Product
- Parsblogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Sep 15, 2008Multiple SQL injection vulnerabilities in index.php in phsBlog 0.2 allow remote attackers to execute arbitrary SQL commands via (1) the sid parameter in a pickuCVE-2008-4072 · Other software · Phsdev · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in index.php in phsBlog 0.2 allow remote attackers to execute arbitrary SQL commands via (1) the sid parameter in a pickup action or (2) the sql_cid parameter, different vectors than CVE-2008-3588.
- Product
- Phsblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Aug 11, 2008Multiple SQL injection vulnerabilities in phsBlog 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to comments.php, (2) CVE-2008-3588 · Other software · Phsblog · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in phsBlog 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to comments.php, (2) cid parameter to index.php, and the (3) urltitle parameter to entries.php.
- Product
- Phsblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comexchange.xforce.ibmcloud.com
Jun 11, 2008Multiple SQL injection vulnerabilities in index.php in Insanely Simple Blog 0.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameteCVE-2008-2670 · Other software · Insanelysimple2 · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in index.php in Insanely Simple Blog 0.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter, or (2) the term parameter in a search action. NOTE: the current_subsection parameter is already covered by CVE-2007-3889.
- Product
- Isblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchroot.orgsecurityreason.com
Nov 5, 2007Cross-site request forgery (CSRF) vulnerability in blocks_edit_do.php in sBlog 0.7.3 Beta allows remote attackers to change arbitrary blocks as administrators.CVE-2007-5818 · Other software · Sblog · reported by MITREHigh 7.6
Cross-site request forgery (CSRF) vulnerability in blocks_edit_do.php in sBlog 0.7.3 Beta allows remote attackers to change arbitrary blocks as administrators.
- Product
- Sblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0x90.com.arsecunia.com
Jul 31, 2007Cross-site scripting (XSS) vulnerability in search.php for sBlog 0.7.3 Beta allows remote attackers to inject arbitrary HTML and web script via a leading '"/></CVE-2007-4102 · Other software · Sblog · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in search.php for sBlog 0.7.3 Beta allows remote attackers to inject arbitrary HTML and web script via a leading '"/></> sequence in the search string.
- Product
- Sblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Apr 2, 2007Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arbitrary local files via a ..CVE-2007-1801 · Other software · Sblog · reported by MITREHigh 7.5
Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conf_lang_default parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by inc/lang.php.
- Product
- Sblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityfocus.com
Jan 22, 2007Cross-site scripting (XSS) vulnerability in blog.php in OdysseusBlog allows remote attackers to inject arbitrary web script or HTML via the page parameter.CVE-2006-6951 · Other software · Odysseus Blog · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in blog.php in OdysseusBlog allows remote attackers to inject arbitrary web script or HTML via the page parameter.
- Product
- Odysseus Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityreason.com
May 4, 2006SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.CVE-2006-2189 · Other software · Servous · reported by MITREHigh 10
SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: this issue can be used to trigger path disclosure. In addition, it might be primary to vector 1 in CVE-2006-1135.
- Product
- Sblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comosvdb.org
Mar 9, 2006Multiple cross-site scripting (XSS) vulnerabilities in sBlog 0.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter tCVE-2006-1135 · Other software · Sblog · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in sBlog 0.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to search.php or (2) username parameter to comments_do.php.
- Product
- Sblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkiki91.altervista.orgsecunia.com
Jan 6, 2006Multiple cross-site scripting (XSS) vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via tCVE-2006-0101 · Other software · Sblog · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p and (2) keyword parameters in (a) index.php and (b) search.php.
- Product
- Sblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2004Cross-site scripting (XSS) vulnerability in the Activity and Events Viewer for Newtelligence DasBlog allows remote attackers to inject arbitrary web script or HCVE-2004-1657 · Other software · Newtelligence · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Activity and Events Viewer for Newtelligence DasBlog allows remote attackers to inject arbitrary web script or HTML via the (1) User Agent or (2) Referrer HTTP headers.
- Product
- Dasblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.