Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Oct 24, 2026GeoDirectory: Does not correctly verify ownership of listings submitted by logged-out users before allowing them to be editedCVE-2026-113674 · WordPress plugins & themes · reported by WPScanLow 3.7
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
- Product
- GeoDirectory
- Fixed in
- 2.8.194
- What to do
- Update GeoDirectory to 2.8.194 or newer.
Oct 11, 2026Web Vitals Tracking: Does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative pageCVE-2026-87760 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.
- Product
- Web Vitals Tracking
- Affected
- up to 5.4.2
- What to do
- Affects up to 5.4.2. Update Web Vitals Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2026BuildKit: Does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL queryCVE-2026-94298 · WordPress plugins & themes · reported by WPScanMedium 6.2
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.
- Product
- BuildKit
- Fixed in
- 1.0.29
- What to do
- Update BuildKit to 1.0.29 or newer.
Sep 13, 2026CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by otheCVE-2026-90768 · Other software · kevoreilly · reported by VulnCheckHigh 8.6
CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.
- Product
- CAPEv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 3276CVE-2022-51017 · Other software · pmmp · reported by VulnCheckHigh 8.7
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.
- Product
- PocketMine-MP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026FAQ Builder AYS: Does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area pageCVE-2026-81737 · WordPress plugins & themes · reported by WPScanHigh 8.8
The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute in the context of a logged in administrator.
- Product
- FAQ Builder AYS
- Fixed in
- 1.8.5
- What to do
- Update FAQ Builder AYS to 1.8.5 or newer.
Aug 27, 202612 Step Meeting List: Does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area pageCVE-2026-78333 · WordPress plugins & themes · reported by WPScanHigh 8.8
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.
- Product
- 12 Step Meeting List
- Fixed in
- 3.19.17
- What to do
- Update 12 Step Meeting List to 3.19.17 or newer.
Aug 2, 2026Event Booking Manager for WooCommerce: Does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event pageCVE-2026-16063 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.3.7
- What to do
- Update Event Booking Manager for WooCommerce to 5.3.7 or newer.
Jul 21, 2026Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticatCVE-2026-63144 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered.CVE-2023-43192 · Other software · Jrecms · reported by MITREHigh 8.8
SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statement.
- Product
- Springbootcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2023In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.CVE-2023-40787 · Other software · Bladex · reported by MITRECritical 9.8
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
- Product
- Springblade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsword.bladex.cn
May 31, 2023Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitivCVE-2023-2749 · Network & remote access · ASUSTOR · reported by security@asustor.comHigh 8.6
Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below.
- Product
- Download Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasustor.comasustor.com
Mar 6, 2023Replyable: Does not validate the class name submitted by the requestCVE-2022-4265 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the prompt_dismiss_notice action and also lacks CSRF check in the related action. This could allow any authenticated users, such as subscriber to perform Object Injection attacks. The attack could also be done via a CSRF vector against any authenticated user
- Product
- Replyable
- Fixed in
- 2.2.10
- What to do
- Update Replyable to 2.2.10 or newer.
Oct 11, 2021Coming soon and Maintenance mode: Does not properly sanitize inputs submitted by authenticated usersCVE-2021-24577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.5.3
- What to do
- Update Coming soon and Maintenance mode to 3.5.3 or newer.
Jan 4, 2010Cross-site scripting (XSS) vulnerability in the Submitted By module 6.x before 6.x-1.3 for Drupal allows remote authenticated users, with "administer content tyCVE-2009-4559 · Other software · Nanwich · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Submitted By module 6.x before 6.x-1.3 for Drupal allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via an input string for "submitted by" text.
- Product
- Submitted BY
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrupal.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.