Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
97 results · page 1 of 2
Oct 29, 2026Schema App Structured Data: Stored Cross-Site ScriptingCVE-2026-96666 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled the plugin's 'Remove Microdata' option and approves the malicious comment.
- Product
- Schema App Structured Data
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2026MasterStudy LMS: Does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructorCVE-2026-88849 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.55
- What to do
- Update MasterStudy LMS to 3.7.55 or newer.
Oct 16, 2026Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2026-96570 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.
- Product
- Schema & Structured Data for WP & AMP
- Affected
- up to 1.67
- What to do
- Affects up to 1.67. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 7, 2026MPG: Does not properly validate the structure of imported project data before using it in a database queryCVE-2026-104953 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
- Product
- MPG
- Fixed in
- 4.2.3
- What to do
- Update MPG to 4.2.3 or newer.
Sep 30, 2026Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.CVE-2026-97291 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
- Affected
- up to 1.66
- What to do
- Affects up to 1.66. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Schema & Structured Data for WP & AMP: Does not perform a capability checkCVE-2026-82127 · WordPress plugins & themes · reported by WPScanLow 3.5
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.67
- What to do
- Update Schema & Structured Data for WP & AMP to 1.67 or newer.
Sep 23, 2026WP Recipe Maker: Does not remove shortcodes from comment content before expanding it while building a page's structured metadataCVE-2026-86601 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
- Product
- WP Recipe Maker
- Fixed in
- 10.8.2
- What to do
- Update WP Recipe Maker to 10.8.2 or newer.
Sep 16, 2026Schema & Structured Data for WP & AMP: Does not check that a user is allowed to edit the specific post they request schema generation forCVE-2026-82126 · WordPress plugins & themes · reported by WPScanLow 2.7
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.66
- What to do
- Update Schema & Structured Data for WP & AMP to 1.66 or newer.
Sep 16, 2026Schema & Structured Data for WP & AMP: Does not correctly verify the ownership or the moderation status of a comment before returning its contentCVE-2026-82125 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.66
- What to do
- Update Schema & Structured Data for WP & AMP to 1.66 or newer.
Sep 16, 2026Schema & Structured Data for WP & AMP: Does not check whether a post is password protected before including its content in the structured data it generatesCVE-2026-82124 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.66
- What to do
- Update Schema & Structured Data for WP & AMP to 1.66 or newer.
Sep 12, 2026SureRank SEO: Does not exclude users' registered account email addresses from the structured data it outputs on public pages by defaultCVE-2026-78152 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content.
- Product
- SureRank SEO
- Fixed in
- 1.10.1
- What to do
- Update SureRank SEO to 1.10.1 or newer.
Sep 3, 2026LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inCVE-2026-82024 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary JavaScript through the answer title parameter, which is rendered through an unescaped HTML sink to execute in the browsers of any user who views the affected quiz question, including students, other instructors, and administrators.
- Fixed in
- 4.4.6
- What to do
- Update the plugin to 4.4.6 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Sep 3, 2026LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor roleCVE-2026-82023 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.
- Fixed in
- 4.4.6
- What to do
- Update the plugin to 4.4.6 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.CVE-2026-81295 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
- Affected
- up to 5.82
- What to do
- Affects up to 5.82. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Sina Extension for Elementor: Does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML responseCVE-2026-14190 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.
- Product
- Sina Extension for Elementor
- Fixed in
- 3.10.2
- What to do
- Update Sina Extension for Elementor to 3.10.2 or newer.
Jul 10, 2026UnderConstructionPage PRO: Arbitrary File ReadCVE-2026-11426 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin accepting arbitrary local file paths in the template_thumbnail parameter and copying their contents into a publicly accessible uploads file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary files on the server, which can contain sensitive information.
- Product
- UnderConstructionPage PRO
- Affected
- up to 5.76
- What to do
- Affects up to 5.76. Update UnderConstructionPage PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordunderconstructionpage.comwordfence.com
Jul 2, 2026Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.CVE-2026-57763 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 10, 2026Schema & Structured Data for WP & AMP: Does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media typeCVE-2026-9067 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.60
- What to do
- Update Schema & Structured Data for WP & AMP to 1.60 or newer.
Jun 2, 2026Constructor: Missing AuthorizationCVE-2025-53302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Anton Shevchuk Constructor allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Constructor: from n/a through 1.6.5.
- Product
- Constructor
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Constructor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 12, 2026WP SEO Structured Data Schema: Stored Cross-Site ScriptingCVE-2026-3604 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `_kcseo_ative_tab` parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP SEO Structured Data Schema
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update WP SEO Structured Data Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Server-Side Request Forgery (SSRF)CVE-2026-39464 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Server Side Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.
- Product
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Affected
- up to 6.19.8
- What to do
- Affects up to 6.19.8. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 7, 2026Under Construction, Coming Soon & Maintenance Mode: Cross-Site Request Forgery (CSRF)CVE-2026-34896 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Forgery.This issue affects Under Construction, Coming Soon & Maintenance Mode: from n/a through 2.1.1.
- Product
- Under Construction, Coming Soon & Maintenance Mode
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Under Construction, Coming Soon & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026m2 | Construction and Tools Store: Deserialization of Untrusted DataCVE-2026-22500 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.
- Product
- m2 | Construction and Tools Store
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update m2 | Construction and Tools Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2026WP DSGVO Tools (GDPR): Unauthorized account destructionCVE-2026-4283 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to the `super-unsubscribe` AJAX action accepting a `process_now` parameter from unauthenticated users, which bypasses the intended email-confirmation flow and immediately triggers irreversible account anonymization. This makes it possible for unauthenticated attackers to permanently destroy any non-administrator user account (password randomized, username/email overwritten, roles stripped, comments anonymized, sensitive usermeta wiped) by submitting the victim's email address with `process_now=1`. The nonce required for the request is publicly available on any page containing the `[unsubscribe_form]` shortcode.
- Product
- WP DSGVO Tools (GDPR)
- Affected
- up to 3.1.38
- What to do
- Affects up to 3.1.38. Update WP DSGVO Tools (GDPR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2026Construction Landing Page: Missing AuthorizationCVE-2026-32338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Construction Landing Page construction-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Landing Page: from n/a through <= 1.4.1.
- Product
- Construction Landing Page
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Construction Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Missing AuthorizationCVE-2026-27368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.
- Product
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Affected
- up to 6.19.8
- What to do
- Affects up to 6.19.8. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2025-14069 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Schema & Structured Data for WP & AMP
- Affected
- up to 1.54
- What to do
- Affects up to 1.54. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025Construction Light: Missing AuthorizationCVE-2025-62960 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Light: from n/a through <= 1.6.7.
- Product
- Construction Light
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Construction Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2025Construction Light: Does not have authorisation and CSRFCVE-2025-10684 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
- Product
- Construction Light
- Fixed in
- 1.6.8
- What to do
- Update Construction Light to 1.6.8 or newer.
Nov 1, 2025Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2025-11502 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Schema & Structured Data for WP & AMP
- Affected
- up to 1.51
- What to do
- Affects up to 1.51. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025Constructor: Unauthorized modification of dataCVE-2025-9194 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() function in all versions up to, and including, 1.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a theme clean.
- Product
- Constructor
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Constructor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.svn.wordpress.orgwordfence.com
Oct 1, 2025Schema & Structured Data for WP & AMP: Does not properly handles HTML tag attribute modificationsCVE-2025-9512 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.50 does not properly handles HTML tag attribute modifications, making it possible for unauthenticated attackers to conduct Stored XSS attacks via post comments.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.50
- What to do
- Update Schema & Structured Data for WP & AMP to 1.50 or newer.
Sep 22, 2025Constructo: Cross-Site Request Forgery (CSRF)CVE-2025-58244 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Anps Constructo constructo allows Object Injection.This issue affects Constructo: from n/a through <= 4.3.9.
- Product
- Constructo
- Affected
- up to 4.3.9
- What to do
- Affects up to 4.3.9. Update Constructo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Structured Content (JSON-LD) #wpsc: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-3414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Structured Content (JSON-LD) #wpsc
- Fixed in
- 1.7.0
- What to do
- Update Structured Content (JSON-LD) #wpsc to 1.7.0 or newer.
Jul 24, 2025Structured Content: Stored Cross-Site ScriptingCVE-2025-4608 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Structured Content
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Structured Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025WP Maintenance Mode & Site Under Construction: Cross-Site Request Forgery (CSRF)CVE-2025-49284 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through <= 4.3.
- Product
- WP Maintenance Mode & Site Under Construction
- Affected
- up to 4.3
- What to do
- Affects up to 4.3. Update WP Maintenance Mode & Site Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2025WP SEO Structured Data Schema: Stored Cross-Site ScriptingCVE-2025-4127 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Price Range’ parameter in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that will execute whenever an administrator accesses the plugin settings page.
- Product
- WP SEO Structured Data Schema
- Affected
- up to 2.7.11
- What to do
- Affects up to 2.7.11. Update WP SEO Structured Data Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2025Really Simple Under Construction Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47593 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonas Hjalmarsson Really Simple Under Construction Page really-simple-under-construction allows Stored XSS.This issue affects Really Simple Under Construction Page: from n/a through <= 1.4.6.
- Product
- Really Simple Under Construction Page
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Really Simple Under Construction Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Eazy Under Construction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob Scott Eazy Under Construction eazy-under-construction allows Reflected XSS.This issue affects Eazy Under Construction: from n/a through <= 1.0.
- Product
- Eazy Under Construction
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Eazy Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JSON Structuring Markup: Cross-Site Request Forgery (CSRF)CVE-2025-31908 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui JSON Structuring Markup json-structuring-markup allows Stored XSS.This issue affects JSON Structuring Markup: from n/a through <= 0.1.
- Product
- JSON Structuring Markup
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update JSON Structuring Markup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Structured Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30918 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme Structured Content structured-content allows Stored XSS.This issue affects Structured Content: from n/a through <= 1.6.3.
- Product
- Structured Content
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Structured Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Active Products Tables for WooCommerce. Use constructor to create tables: Unauthorized filter callingCVE-2025-1514 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including, 1.0.6.7. This makes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter.
- Product
- Active Products Tables for WooCommerce. Use constructor to create tables
- Affected
- up to 1.0.6.7
- What to do
- Affects up to 1.0.6.7. Update Active Products Tables for WooCommerce. Use constructor to create tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2025Builder for Contact Form 7 by Webconstruct: Cross-Site Request Forgery (CSRF)CVE-2025-28864 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through <= 1.2.2.
- Product
- Builder for Contact Form 7 by Webconstruct
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Builder for Contact Form 7 by Webconstruct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 4, 2025Structured Content (JSON-LD) #wpsc: Stored Cross-Site ScriptingCVE-2025-0512 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to, and including, 6.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Structured Content (JSON-LD) #wpsc
- Affected
- up to 6.4.5
- What to do
- Affects up to 6.4.5. Update Structured Content (JSON-LD) #wpsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 3, 2025Mojo Under Construction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23850 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojowill Mojo Under Construction mojo-under-construction allows Reflected XSS.This issue affects Mojo Under Construction: from n/a through <= 1.1.2.
- Product
- Mojo Under Construction
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Mojo Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2025Active Products Tables for WooCommerce. Use constructor to create tables: Reflected Cross-Site ScriptingCVE-2025-0864 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodes_set' parameter in all versions up to, and including, 1.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Active Products Tables for WooCommerce. Use constructor to create tables
- Affected
- up to 1.0.6.6
- What to do
- Affects up to 1.0.6.6. Update Active Products Tables for WooCommerce. Use constructor to create tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2025Library Instruction Recorder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23646 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Brooks Library Instruction Recorder library-instruction-recorder allows Reflected XSS.This issue affects Library Instruction Recorder: from n/a through <= 1.1.4.
- Product
- Library Instruction Recorder
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Library Instruction Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Cross-Site Request Forgery (CSRF)CVE-2025-24540 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Cross Site Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.18.9.
- Product
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Affected
- up to 6.18.9
- What to do
- Affects up to 6.18.9. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Construction Landing Page: Cross-Site Request Forgery (CSRF)CVE-2024-37508 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raratheme Construction Landing Page construction-landing-page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through <= 1.3.5.
- Product
- Construction Landing Page
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Construction Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Schema App Structured Data: Missing AuthorizationCVE-2023-44258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vberkel Schema App Structured Data schema-app-structured-data-for-schemaorg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schema App Structured Data: from n/a through <= 1.23.1.
- Product
- Schema App Structured Data
- Affected
- up to 1.23.1
- What to do
- Affects up to 1.23.1. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.