Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
85 results · page 1 of 2
Oct 25, 2026GiveWP: Does not correctly determineCVE-2026-111980 · WordPress plugins & themes · reported by WPScanMedium 5.5
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.
- Product
- GiveWP
- Fixed in
- 4.19.0.1
- What to do
- Update GiveWP to 4.19.0.1 or newer.
Oct 23, 2026Otter Blocks: Does not correctly determine whether a post is publicly readable before returning its data through a REST API endpointCVE-2026-109934 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 21, 2026LatePoint: Does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allowCVE-2026-105256 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
- Product
- LatePoint
- Fixed in
- 5.7.5
- What to do
- Update LatePoint to 5.7.5 or newer.
Oct 21, 2026Advanced File Manager: Does not correctly determine whether a stored file is an SVG before sanitising itCVE-2026-79627 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
- Product
- Advanced File Manager
- Fixed in
- 6.0.0
- What to do
- Update Advanced File Manager to 6.0.0 or newer.
Oct 19, 2026Sensei LMS: Contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafCVE-2026-112328 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
- Product
- Sensei LMS
- Fixed in
- 4.26.4
- What to do
- Update Sensei LMS to 4.26.4 or newer.
Full record and what to do →NVD recordsenseilms.comvulncheck.com
Oct 17, 2026Ukr-To-Lat: Does not sanitize and escape a term name before using it in a SQL queryCVE-2026-104122 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.
- Product
- Ukr-To-Lat
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Ukr-To-Lat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2026All in One SEO: Does not correctly determineCVE-2026-19856 · WordPress plugins & themes · reported by WPScanMedium 6.5
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older versions the protection is disabled outright, making the issue reachable without any crafted input.
- Product
- All in One SEO
- Fixed in
- 5.0.2.1
- What to do
- Update All in One SEO to 5.0.2.1 or newer.
Sep 30, 2026Media Library Organizer: Does not verify that the requesting user holds the target taxonomy's management capability before creating a new termCVE-2026-94297 · WordPress plugins & themes · reported by WPScanLow 2.7
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.
- Product
- Media Library Organizer
- Fixed in
- 2.1.4
- What to do
- Update Media Library Organizer to 2.1.4 or newer.
Sep 16, 2026Tutor LMS: Does not correctly determine whether an incoming request is addressed to its own REST APICVE-2026-85569 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.
- Product
- Tutor LMS
- Fixed in
- 4.0.8
- What to do
- Update Tutor LMS to 4.0.8 or newer.
Sep 12, 2026BEAR: Does not verify a CSRF nonce or check user capabilities before updating taxonomy termsCVE-2026-84023 · WordPress plugins & themes · reported by WPScanMedium 6.5
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
- Product
- BEAR
- Fixed in
- 1.2.2
- What to do
- Update BEAR to 1.2.2 or newer.
Aug 26, 2026Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates: Does not include an authorization check on a REST route that returns stored account dataCVE-2026-16984 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration.
- Product
- Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates
- Fixed in
- 3.7.1
- What to do
- Update Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates to 3.7.1 or newer.
Aug 26, 2026Royal Addons for Elementor: Does not perform any capability or nonce check before returning taxonomy term data for an arbitraryCVE-2026-13406 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.
- Product
- Royal Addons for Elementor
- Fixed in
- 1.7.1066
- What to do
- Update Royal Addons for Elementor to 1.7.1066 or newer.
Aug 10, 2026Term Pages: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-16949 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Term Pages
- Fixed in
- 2.0.0
- What to do
- Update Term Pages to 2.0.0 or newer.
Jul 30, 2026Frontend Admin by DynamiApps: Does not perform capability checks on its taxonomy term creationCVE-2026-11867 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, and delete arbitrary taxonomy terms.
- Product
- Frontend Admin by DynamiApps
- Fixed in
- 3.29.7
- What to do
- Update Frontend Admin by DynamiApps to 3.29.7 or newer.
Jul 20, 2026Tag Groups is the Advanced Way to Display Your Taxonomy Terms: Does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content typeCVE-2026-9833 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.
- Product
- Tag Groups is the Advanced Way to Display Your Taxonomy Terms
- Fixed in
- 2.2.0
- What to do
- Update Tag Groups is the Advanced Way to Display Your Taxonomy Terms to 2.2.0 or newer.
Mar 25, 2026WP Terms Popup: Missing AuthorizationCVE-2026-32495 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Link Software LLC WP Terms Popup wp-terms-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Terms Popup: from n/a through <= 2.10.0.
- Product
- WP Terms Popup
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update WP Terms Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Terms descriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24621 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows DOM-Based XSS.This issue affects Terms descriptions: from n/a through <= 3.4.9.
- Product
- Terms descriptions
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update Terms descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Anything Order by Terms: Missing AuthorizationCVE-2026-24567 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Anything Order by Terms: from n/a through <= 1.4.0.
- Product
- Anything Order by Terms
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Anything Order by Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP Term Order: Cross-Site Request Forgery (CSRF)CVE-2026-24542 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Term Order wp-term-order allows Cross Site Request Forgery.This issue affects WP Term Order: from n/a through <= 2.1.0.
- Product
- WP Term Order
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Term Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Pro Bulk Watermark Plugin for: Path Traversal: '.../...//'CVE-2025-28973 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through <= 2.0.
- Product
- Pro Bulk Watermark Plugin for
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Pro Bulk Watermark Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Terms descriptions: Insertion of Sensitive Information Into Sent DataCVE-2025-62139 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows Retrieve Embedded Sensitive Data.This issue affects Terms descriptions: from n/a through <= 3.4.10.
- Product
- Terms descriptions
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update Terms descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Create Posts & Terms: Cross-Site Request Forgery (CSRF)CVE-2025-49351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Valentin Agachi Create Posts & Terms create-posts-terms allows Stored XSS.This issue affects Create Posts & Terms: from n/a through <= 1.3.1.
- Product
- Create Posts & Terms
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Create Posts & Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025I Order Terms: Cross-Site Request Forgery (CSRF)CVE-2025-66097 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Terms: from n/a through <= 1.5.0.
- Product
- I Order Terms
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update I Order Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Unauthorized modification of dataCVE-2025-11816 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disconnect_account_request() function in all versions up to, and including, 3.5.1. This makes it possible for unauthenticated attackers to disconnect the site from its API plan.
- Product
- Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2025Terms Dictionary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39534 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through <= 1.5.1.
- Product
- Terms Dictionary
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Terms Dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Termageddon: Cookie Consent & Privacy Compliance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58026 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in termageddon Termageddon: Cookie Consent & Privacy Compliance termageddon-usercentrics allows Stored XSS.This issue affects Termageddon: Cookie Consent & Privacy Compliance: from n/a through <= 1.8.1.
- Product
- Termageddon: Cookie Consent & Privacy Compliance
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Termageddon: Cookie Consent & Privacy Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Ultimate Watermark: Missing AuthorizationCVE-2025-57985 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through <= 1.1.
- Product
- Ultimate Watermark
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Ultimate Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2025Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Unauthorized access of functionalityCVE-2025-8565 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplp_gdpr_install_plugin_ajax_handler() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to install arbitrary repository plugins.
- Product
- Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 5, 2025Bulk Watermark: Cross-Site Request Forgery (CSRF)CVE-2025-58845 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Bulk Watermark bulk-watermark allows Reflected XSS.This issue affects Bulk Watermark: from n/a through <= 1.6.10.
- Product
- Bulk Watermark
- Affected
- up to 1.6.10
- What to do
- Affects up to 1.6.10. Update Bulk Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2025Pro Bulk Watermark Plugin for: Path Traversal: '.../...//'CVE-2025-4956 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through 2.0.
- Product
- Pro Bulk Watermark Plugin for
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Pro Bulk Watermark Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been cCVE-2025-8047 · WordPress plugins & themes · reported by WPScanCritical 9.8
The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert marketing security services. Users that pay are added to allowedDomains to suppress the popup.
- What to do
- Update the plugin to the newest version.
Jul 18, 2025Terms descriptions: Stored Cross-Site ScriptingCVE-2025-6719 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Terms descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Terms descriptions
- Affected
- up to 3.4.8
- What to do
- Affects up to 3.4.8. Update Terms descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jun 27, 2025Evangelische Termine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in regibaer Evangelische Termine evangtermine allows Reflected XSS.This issue affects Evangelische Termine: from n/a through <= 3.3.
- Product
- Evangelische Termine
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Evangelische Termine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employeesCVE-2024-12812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.
- Product
- WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
- Fixed in
- 1.13.4
- What to do
- Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
May 7, 2025Terms Popup On User Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47592 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Árpád Lehel Mátyus Terms Popup On User Login terms-popup-on-user-login allows Stored XSS.This issue affects Terms Popup On User Login: from n/a through <= 2.0.8.
- Product
- Terms Popup On User Login
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Terms Popup On User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Terminal Africa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32515 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in terminalafrica Terminal Africa terminal-africa allows Reflected XSS.This issue affects Terminal Africa: from n/a through <= 1.13.24.
- Product
- Terminal Africa
- Affected
- up to 1.13.24
- What to do
- Affects up to 1.13.24. Update Terminal Africa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Term Taxonomy Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dhanendran Rajagopal Term Taxonomy Converter term-taxonomy-converter allows Reflected XSS.This issue affects Term Taxonomy Converter: from n/a through <= 1.2.
- Product
- Term Taxonomy Converter
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Term Taxonomy Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Bulk Term Editor: Cross-Site Request Forgery (CSRF)CVE-2025-39512 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yuya Hoshino Bulk Term Editor bulk-term-editor allows Cross Site Request Forgery.This issue affects Bulk Term Editor: from n/a through <= 1.1.4.
- Product
- Bulk Term Editor
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Bulk Term Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Terms Before Download: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31614 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hiroprot Terms Before Download terms-before-download allows Stored XSS.This issue affects Terms Before Download: from n/a through <= 1.0.5.
- Product
- Terms Before Download
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Terms Before Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025Terms of Use: Cross-Site Request Forgery (CSRF)CVE-2025-31440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Terms of Use terms-of-use-2 allows Stored XSS.This issue affects Terms of Use: from n/a through <= 2.0.
- Product
- Terms of Use
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Terms of Use to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Terms & Conditions Per Product: Missing AuthorizationCVE-2025-30866 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Terms & Conditions Per Product: from n/a through <= 1.2.15.
- Product
- Terms & Conditions Per Product
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update Terms & Conditions Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025DP ALTerminator - Missing ALT manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28943 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager dp-alterminator-missing-alt-manager allows Stored XSS.This issue affects DP ALTerminator - Missing ALT manager: from n/a through <= 1.0.2.
- Product
- DP ALTerminator - Missing ALT manager
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update DP ALTerminator - Missing ALT manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Heartland Management Terminal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecureSubmit Heartland Management Terminal allows Reflected XSS. This issue affects Heartland Management Terminal: from n/a through 1.3.0.
- Product
- Heartland Management Terminal
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Heartland Management Terminal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Marekkis Watermark: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23425 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marekki Marekkis Watermark marekkis-watermark allows Reflected XSS.This issue affects Marekkis Watermark: from n/a through <= 0.9.4.
- Product
- Marekkis Watermark
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Marekkis Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025CGD Arrange Terms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23752 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clifton Griffin CGD Arrange Terms shopp-arrange allows Reflected XSS.This issue affects CGD Arrange Terms: from n/a through <= 1.1.3.
- Product
- CGD Arrange Terms
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update CGD Arrange Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Taxonomy/Term and Role based Discounts for WooCommerce: Missing AuthorizationCVE-2025-24625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through <= 5.1.
- Product
- Taxonomy/Term and Role based Discounts for WooCommerce
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update Taxonomy/Term and Role based Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 25, 2024Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Cross-Site Request ForgeryCVE-2024-12636 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.6. This is due to missing or incorrect nonce validation on the 'create_popup_delete_process' function. This makes it possible for unauthenticated attackers to delete popups via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 16, 2024Termin-Kalender: Missing AuthorizationCVE-2024-54354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in beat.k Termin-Kalender termin-kalender allows Stored XSS.This issue affects Termin-Kalender: from n/a through <= 0.99.47.
- Product
- Termin-Kalender
- Affected
- up to 0.99.47
- What to do
- Affects up to 0.99.47. Update Termin-Kalender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024Hotlink2Watermark: Cross-Site Request Forgery (CSRF)CVE-2024-53711 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in tranchesdunet Hotlink2Watermark hotlink2watermark allows Stored XSS.This issue affects Hotlink2Watermark: from n/a through <= 0.3.2.
- Product
- Hotlink2Watermark
- Affected
- up to 0.3.2
- What to do
- Affects up to 0.3.2. Update Hotlink2Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Display Terms Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seothemes Display Terms Shortcode display-terms-shortcode allows Stored XSS.This issue affects Display Terms Shortcode: from n/a through <= 1.0.4.
- Product
- Display Terms Shortcode
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Display Terms Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.