Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Oct 17, 2025Binary MLM Plan: Insecure direct object referenceCVE-2025-11895 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying ownership. This makes it possible for authenticated attackers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-account-detail/ endpoint with a crafted payout-id parameter granted they can access the shortcode output.
- Product
- Binary MLM Plan
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update Binary MLM Plan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2025Binary MLM Plan: Limited Privilege EscalationCVE-2025-10038 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's form. This makes it possible for unauthenticated attackers to register and manage the plugin's settings.
- Product
- Binary MLM Plan
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Binary MLM Plan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 23, 2025Binary MLM Plan: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47671 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LETSCMS MLM Software Binary MLM Plan binary-mlm-plan allows SQL Injection.This issue affects Binary MLM Plan: from n/a through <= 3.0.
- Product
- Binary MLM Plan
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Binary MLM Plan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Binary MLM Woocommerce: Reflected Cross-Site ScriptingCVE-2024-12384 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Binary MLM Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page’ parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Binary MLM Woocommerce
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Binary MLM Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Binary MLM Woocommerce: Cross-Site Request ForgeryCVE-2024-12383 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'bmw_display_pv_set_page' function and insufficient input sanitization and output escaping of the 'product_points' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Binary MLM Woocommerce
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Binary MLM Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 12, 2024Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter: Missing AuthorizationCVE-2024-37202 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BinaryCarpenter Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter custom-add-to-cart-button-for-woocommerce.This issue affects Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter: from n/a through <= 1.222.17.
- Product
- Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter
- Affected
- up to 1.222.17
- What to do
- Affects up to 1.222.17. Update Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 17, 2024Custom Thank You Page Customize For WooCommerce by Binary Carpenter: Missing AuthorizationCVE-2024-32517 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WooCommerce & WordPress Tutorials Custom Thank You Page Customize For WooCommerce by Binary Carpenter.This issue affects Custom Thank You Page Customize For WooCommerce by Binary Carpenter: from n/a through 1.4.12.
- Product
- Custom Thank You Page Customize For WooCommerce by Binary Carpenter
- Affected
- up to 1.4.12
- What to do
- Affects up to 1.4.12. Update Custom Thank You Page Customize For WooCommerce by Binary Carpenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Menu Bar Cart Icon For WooCommerce By Binary Carpenter: Cross-Site Request Forgery (CSRF)CVE-2023-49855 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in BinaryCarpenter Menu Bar Cart Icon For WooCommerce By Binary Carpenter.This issue affects Menu Bar Cart Icon For WooCommerce By Binary Carpenter: from n/a through 1.49.3.
- Product
- Menu Bar Cart Icon For WooCommerce By Binary Carpenter
- Affected
- up to 1.49.3
- What to do
- Affects up to 1.49.3. Update Menu Bar Cart Icon For WooCommerce By Binary Carpenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.