Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Jul 8, 2026Appointment Booking Calendar Plugin and Scheduling: Does not validate data before passing it to a PHP deserialization functionCVE-2026-12378 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.
- Product
- Appointment Booking Calendar Plugin and Scheduling
- Affected
- up to 1.1.28
- What to do
- Affects up to 1.1.28. Update Appointment Booking Calendar Plugin and Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025User Registration & Membership: Does not properly validate data in an AJAX actionCVE-2025-2594 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.
- Product
- User Registration & Membership
- Fixed in
- 4.1.3
- What to do
- Update User Registration & Membership to 4.1.3 or newer.
Jan 16, 2024Contact Form Entries: Does not validate dataCVE-2022-3604 · WordPress plugins & themes · reported by WPScanHigh 7.8
The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection.
- Product
- Contact Form Entries
- Fixed in
- 1.3.0
- What to do
- Update Contact Form Entries to 1.3.0 or newer.
Nov 28, 2022Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list: Does not validate dataCVE-2022-3603 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.
- Product
- Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list
- Fixed in
- 2.0.69
- What to do
- Update Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list to 2.0.69 or newer.
Nov 21, 2022Contact Form 7 Database Addon: Does not validate dataCVE-2022-3634 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection
- Product
- Contact Form 7 Database Addon
- Fixed in
- 1.2.6.5
- What to do
- Update Contact Form 7 Database Addon to 1.2.6.5 or newer.
Nov 21, 2022Easy Digital Downloads: Does not validate dataCVE-2022-3600 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.
- Product
- Easy Digital Downloads
- Fixed in
- 3.1.0.2
- What to do
- Update Easy Digital Downloads to 3.1.0.2 or newer.
Jul 25, 2022Exports and Reports: Does not sanitize and validate dataCVE-2022-1539 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.
- Product
- Exports and Reports
- Fixed in
- 0.9.2
- What to do
- Update Exports and Reports to 0.9.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.