Updated 27 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

65 results · page 1 of 2

Oct 8, 2026HollerBox: Authorization Bypass Through User-Controlled KeyCVE-2026-106603 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.
Product
HollerBox
Affected
up to 2.3.14
What to do
Affects up to 2.3.14. Update HollerBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 31, 2026ElementsKit Elementor Addons: Does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPCVE-2026-13392 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.
Product
ElementsKit Elementor Addons
Fixed in
3.10.01
What to do
Update ElementsKit Elementor Addons to 3.10.01 or newer.
Full record and what to do →NVD record wpscan.com
Jun 23, 2026Infility Global Infility Global: For WordPress does not sanitize or validate the orderby and order parameters in the import_list()CVE-2026-7842 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
Product
Infility Global Infility Global
Fixed in
2.15.20
What to do
Update Infility Global Infility Global to 2.15.20 or newer.
Full record and what to do →NVD record wpscan.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.CVE-2026-48885 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.
Affected
up to 2.3.10.1
What to do
Affects up to 2.3.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2025Userback: Unauthorized access of dataCVE-2025-14540 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract plugin's configuration data including the Userback API access token and site's posts/pages contents, including those that have private and draft status.
Product
Userback
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Userback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2025Player Leaderboard: Local File InclusionCVE-2025-12824 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shortcode. This is due to the plugin using an unsanitized user-supplied value from the shortcode's 'mode' attribute in a call to include() without proper path validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve full remote code execution if combined with file upload capabilities.
Product
Player Leaderboard
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Player Leaderboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2025PowerBI Embed Reports: Sensitive Information DisclosureCVE-2025-10750 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PowerBI Embed Reports plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.2.0. This is due to missing capability checks and authentication verification on the 'testUser' endpoint accessible via the mo_epbr_admin_observer() function hooked on 'init'. This makes it possible for unauthenticated attackers to access sensitive Azure AD user information including personal identifiable information (PII) such as displayName, mail, phones, department, or detailed OAuth error data including Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs.
Product
PowerBI Embed Reports
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update PowerBI Embed Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Woo superb slideshow transition gallery with random effect: SQL InjectionCVE-2025-9199 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Woo superb slideshow transition gallery with random effect
Affected
up to 9.1
What to do
Affects up to 9.1. Update Woo superb slideshow transition gallery with random effect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 15, 2025ServerBuddy by PluginBuddy.Com: Cross-Site Request Forgery (CSRF)CVE-2025-49895 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5.
Product
ServerBuddy by PluginBuddy.Com
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update ServerBuddy by PluginBuddy.Com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025ViperBar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viperchill ViperBar viperbar allows Reflected XSS.This issue affects ViperBar: from n/a through <= 2.0.
Product
ViperBar
Affected
up to 2.0
What to do
Affects up to 2.0. Update ViperBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Userbase Access Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Userbase Access Control userbase-access-control allows Reflected XSS.This issue affects Userbase Access Control: from n/a through <= 1.0.
Product
Userbase Access Control
Affected
up to 1.0
What to do
Affects up to 1.0. Update Userbase Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025ReverbNation Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25095 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets reverbnation-widgets allows Stored XSS.This issue affects ReverbNation Widgets: from n/a through <= 2.1.
Product
ReverbNation Widgets
Affected
up to 2.1
What to do
Affects up to 2.1. Update ReverbNation Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Daily Proverb: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23859 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jd7777 Daily Proverb daily-proverb allows Stored XSS.This issue affects Daily Proverb: from n/a through <= 2.0.3.
Product
Daily Proverb
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Daily Proverb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WP SuperBackup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Reflected XSS.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56070 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024WP SuperBackup: Deserialization of Untrusted DataCVE-2024-56068 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56067 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024WP SuperBackup: Unrestricted Upload of File with Dangerous TypeCVE-2024-56064 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Product
WP SuperBackup
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024LeaderBoard: Cross-Site Request Forgery (CSRF)CVE-2024-54426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in crossfitatgg LeaderBoard Plugin leaderboard-lite allows Stored XSS.This issue affects LeaderBoard Plugin: from n/a through <= 1.2.4.
Product
LeaderBoard
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update LeaderBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 11, 2024PowerBI Embed Reports: Stored Cross-Site ScriptingCVE-2024-11901 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MO_API_POWER_BI' shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PowerBI Embed Reports
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update PowerBI Embed Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2024The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.CVE-2024-12015 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 7.7
The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record tenable.com
Nov 11, 2024MasterBip para Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masterbip MasterBip para Elementor masterbip-for-elementor allows DOM-Based XSS.This issue affects MasterBip para Elementor: from n/a through <= 1.6.3.
Product
MasterBip para Elementor
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update MasterBip para Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2024Verbalize WP: Unrestricted Upload of File with Dangerous TypeCVE-2024-49668 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in christopherdewese1099 Verbalize WP verbalize-wp allows Upload a Web Shell to a Web Server.This issue affects Verbalize WP: from n/a through <= 1.0.
Product
Verbalize WP
Affected
up to 1.0
What to do
Affects up to 1.0. Update Verbalize WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024Verbosa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Verbosa verbosa allows Stored XSS.This issue affects Verbosa: from n/a through <= 1.2.3.
Product
Verbosa
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Verbosa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 31, 2024WP Cerber Security: IP Protection bypassCVE-2022-4100 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked.
Product
WP Cerber Security
Affected
up to 9.4
What to do
Affects up to 9.4. Update WP Cerber Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.CVE-2023-29428 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.CVE-2023-34371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.
Affected
up to 2.22
What to do
Affects up to 2.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Superb slideshow gallery: SQL InjectionCVE-2023-5434 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Superb slideshow gallery
Affected
up to 13.1
What to do
Affects up to 13.1. Update Superb slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lee Le @ Userback Userback plugin <= 1.0.13 versions.CVE-2023-46089 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Lee Le @ Userback Userback plugin <= 1.0.13 versions.
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023WP Cerber Security: Stored cross-site scriptingCVE-2022-4712 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, and including, 9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Cerber Security
Affected
up to 9.1
What to do
Affects up to 9.1. Update WP Cerber Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Hide Pages plugin <= 1.0 versions.CVE-2023-44232 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Hide Pages plugin <= 1.0 versions.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 2, 2023WP Cerber Security, Anti-spam & Malware Scan: Does not properly block access to the REST API users endpointCVE-2022-4417 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
Product
WP Cerber Security, Anti-spam & Malware Scan
Fixed in
9.3.3
What to do
Update WP Cerber Security, Anti-spam & Malware Scan to 9.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2022Sliderby10Web: Does not sanitise and escape some of its settingsCVE-2022-4197 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Sliderby10Web
Fixed in
1.2.53
What to do
Update Sliderby10Web to 1.2.53 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2022WP Cerber Security: Security protection bypassCVE-2022-2939 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author' parameter found in the ~/cerber-load.php file. In vulnerable versions, the plugin only blocks requests if the value supplied is numeric, making it possible for attackers to supply additional non-numeric characters to bypass the protection. The non-numeric characters are stripped and the user requested is displayed. This can be used by unauthenticated attackers to gather information about users that can targeted in further attacks.
Product
WP Cerber Security
Affected
up to 9.0
What to do
Affects up to 9.0. Update WP Cerber Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the order and orderby parameters before using them in a SQL statementCVE-2022-25811 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection
Product
Transposh WordPress Translation
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022Five Minute Webshop: Does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin pageCVE-2022-1685 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
Product
Five Minute Webshop
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
May 23, 2022Sliderby10Web: Does not properly sanitize and escape some of its settingsCVE-2022-1320 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Sliderby10Web
Fixed in
1.2.52
What to do
Update Sliderby10Web to 1.2.52 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Product
WordPress Zero Spam
Fixed in
5.2.11
What to do
Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2022Email Subscribers & Newsletters: Does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` actionCVE-2022-0439 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
Product
Email Subscribers & Newsletters
Fixed in
5.3.2
What to do
Update Email Subscribers & Newsletters to 5.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022WP Cerber Security, Anti-spam & Malware Scan: Does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboardCVE-2022-0429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
Product
WP Cerber Security, Anti-spam & Malware Scan
Fixed in
8.9.6
What to do
Update WP Cerber Security, Anti-spam & Malware Scan to 8.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Product
Popup Builder
Fixed in
4.0.7
What to do
Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Advanced Custom Fields: Extended: Does not validate the order and orderby parameters before using them in a SQL statementCVE-2021-24865 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
Product
Advanced Custom Fields: Extended
Fixed in
0.8.8.7
What to do
Update Advanced Custom Fields: Extended to 0.8.8.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022Download Monitor: Does not properly validate and escape the "orderby" GET parameter before using it in a SQL statementCVE-2021-24786 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
Product
Download Monitor
Fixed in
4.4.5
What to do
Update Download Monitor to 4.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Rich Reviews by Starfish: Does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statementCVE-2021-24753 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
Product
Rich Reviews by Starfish
Fixed in
1.9.6
What to do
Update Rich Reviews by Starfish to 1.9.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 29, 2021BSK PDF Manager: Does not validate and escape the orderby and order parameters before using them in a SQL statementCVE-2021-24860 · WordPress plugins & themes · reported by WPScanHigh 7.2
The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue
Product
BSK PDF Manager
Fixed in
3.1.2
What to do
Update BSK PDF Manager to 3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Email Before Download: Does not properly validate and escape the order and orderby GET parameters before using them in SQL statementsCVE-2021-24748 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
Product
Email Before Download
Fixed in
6.8
What to do
Update Email Before Download to 6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021MainWP Child: Does not validate the orderby and order parameter before using them in a SQL statementCVE-2021-24877 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
Product
MainWP Child
Fixed in
4.1.8
What to do
Update MainWP Child to 4.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Affiliates Manager: Does not validate the orderby parameter before using it in an SQL statement in the admin dashboardCVE-2021-24844 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue
Product
Affiliates Manager
Fixed in
2.8.7
What to do
Update Affiliates Manager to 2.8.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Header Footer Code Manager: Does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statementCVE-2021-24791 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections
Product
Header Footer Code Manager
Fixed in
1.1.14
What to do
Update Header Footer Code Manager to 1.1.14 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Check & Log Email: Does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statementCVE-2021-24774 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
Product
Check & Log Email
Fixed in
1.0.3
What to do
Update Check & Log Email to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.