Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

43 results

Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.CVE-2026-66673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
Affected
up to 2.0
What to do
Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.CVE-2026-66672 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
Affected
up to 2.0
What to do
Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Flatsome: Missing AuthorizationCVE-2026-57729 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.
Product
Flatsome
Affected
up to 3.20.5
What to do
Affects up to 3.20.5. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Flatsome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57728 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XSS.This issue affects Flatsome: from n/a through <= 3.20.5.
Product
Flatsome
Affected
up to 3.20.5
What to do
Affects up to 3.20.5. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Contributor Broken Access Control in Flatsome <= 3.20.5 versions.CVE-2026-57731 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in Flatsome <= 3.20.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Subscriber Broken Access Control in Flatsome <= 3.20.5 versions.CVE-2026-57730 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Flatsome <= 3.20.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.CVE-2024-49269 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.
Affected
up to 0.0.8
What to do
Affects up to 0.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39500 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.3.2.
Product
themesflat-addons-for-elementor
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Flatsome: Missing AuthorizationCVE-2026-31915 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.19.6.
Product
Flatsome
Affected
up to 3.19.6
What to do
Affects up to 3.19.6. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2026Flatsome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28083 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Stored XSS.This issue affects Flatsome: from n/a through <= 3.20.5.
Product
Flatsome
Affected
up to 3.20.5
What to do
Affects up to 3.20.5. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Themesflat Elementor: Deserialization of Untrusted DataCVE-2025-69382 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themesflat Themesflat Elementor themesflat-elementor allows Object Injection.This issue affects Themesflat Elementor: from n/a through <= 1.0.1.
Product
Themesflat Elementor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Themesflat Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026UX Flat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in COP UX Flat ux-flat allows Stored XSS.This issue affects UX Flat: from n/a through <= 5.4.0.
Product
UX Flat
Affected
up to 5.4.0
What to do
Affects up to 5.4.0. Update UX Flat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 20, 2026FlatPM – Ad Manager, AdSense and Custom Code: Stored Cross-Site ScriptingCVE-2026-0690 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rank_math_description' custom field in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FlatPM – Ad Manager, AdSense and Custom Code
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update FlatPM – Ad Manager, AdSense and Custom Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2026Flat Shipping Rate by City for WooCommerce: Time-based SQL InjectionCVE-2026-0678 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Flat Shipping Rate by City for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'cities' parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Flat Shipping Rate by City for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Flat Shipping Rate by City for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2025Flatsome: Stored Cross-Site ScriptingCVE-2025-8684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flatsome
Affected
up to 3.20.0
What to do
Affects up to 3.20.0. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 9, 2025WordPress FlatNews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32305 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit WordPress FlatNews Theme flatnews allows Reflected XSS.This issue affects WordPress FlatNews Theme: from n/a through <= 5.8.
Product
WordPress FlatNews
Affected
up to 5.8
What to do
Affects up to 5.8. Update WordPress FlatNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 19, 2025Themesflat Addons For Elementor: Stored Cross-Site ScriptingCVE-2025-3275 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider widget in all versions up to, and including, 2.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Themesflat Addons For Elementor
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 31, 2025themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31567 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.3.1.
Product
themesflat-addons-for-elementor
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Flatty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31472 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michele Marri Flatty flatty-flat-admin-theme allows Stored XSS.This issue affects Flatty: from n/a through <= 2.0.0.
Product
Flatty
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Flatty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2025Themesflat Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-12205 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Themesflat Addons For Elementor
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows DOM-Based XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.2.2.
Product
themesflat-addons-for-elementor
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024Flat UI Button: Stored Cross-Site ScriptingCVE-2024-10014 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flat UI Button
What to do
Update Flat UI Button to the newest version.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 17, 2024themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.2.0.
Product
themesflat-addons-for-elementor
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 25, 2024Themesflat Addons For Elementor: Information ExposureCVE-2024-8516 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract limited post information from draft and future scheduled posts.
Product
Themesflat Addons For Elementor
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2024Themesflat Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-8515 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like 'TF E Slider Widget', 'TF Video Widget', 'TF Team Widget' and more in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on URL attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Themesflat Addons For Elementor
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Webico Slider Flatsome Addons: Stored Cross-Site ScriptingCVE-2024-5881 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Webico Slider Flatsome Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wbc_image shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Webico Slider Flatsome Addons
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Webico Slider Flatsome Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 21, 2024Flatsome: Stored Cross-Site ScriptingCVE-2024-5346 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Sidebar, and UX Payment Icons shortcodes in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flatsome
Affected
up to 3.18.7
What to do
Affects up to 3.18.7. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 20, 2024Flatsome: Stored Cross-Site ScriptingCVE-2024-5156 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flatsome
Affected
up to 3.18.7
What to do
Affects up to 3.18.7. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 6, 2024Themesflat Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-4459 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Themesflat Addons For Elementor
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024Themesflat Addons For Elementor: Stored Cross-Site Scripting in several widgetsCVE-2024-4458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in several widgets via URL parameters in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Themesflat Addons For Elementor
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 6, 2024Themesflat Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-4212 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TF Group Image, TF Nav Menu, TF Posts, TF Woo Product Grid, TF Accordion, and TF Image Box widgets in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Themesflat Addons For Elementor
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024Themesflat Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-2922 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget tags in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35666 may be a duplicate of this issue.
Product
Themesflat Addons For Elementor
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 4, 2024Themesflat Addons For Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35666 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themesflat Themesflat Addons For Elementor allows Stored XSS.This issue affects Themesflat Addons For Elementor: from n/a through 2.1.2.
Product
Themesflat Addons For Elementor
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 23, 2024Flattr: Does not sanitise and escape some of its settingsCVE-2024-3920 · WordPress plugins & themes · reported by WPScanLow 3.5
The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Flattr
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Flattr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2024FlatPM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mehanoid.Pro FlatPM allows Stored XSS.This issue affects FlatPM: from n/a before 3.1.05.
Product
FlatPM
Fixed in
3.1.05
What to do
Update FlatPM to 3.1.05 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024UX Flat: Stored Cross-Site ScriptingCVE-2024-2459 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The UX Flat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UX Flat
Affected
up to 4.4
What to do
Affects up to 4.4. Update UX Flat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 20, 2023Flatsome | Multi-Purpose Responsive WooCommerce: Deserialization of Untrusted DataCVE-2023-40555 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.
Product
Flatsome | Multi-Purpose Responsive WooCommerce
Affected
up to 3.17.5
What to do
Affects up to 3.17.5. Update Flatsome | Multi-Purpose Responsive WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Themesflat Addons For Elementor: Deserialization of Untrusted DataCVE-2023-37390 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.
Product
Themesflat Addons For Elementor
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce sCVE-2023-34015 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin <= 1.6.4.4 versions.
Fixed in
1.6.4.6
What to do
Update the plugin to 1.6.4.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 12, 2022FlatPM: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2022-3934 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
FlatPM
Fixed in
3.0.13
What to do
Update FlatPM to 3.0.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 14, 2021duoFAQ - Responsive, Flat, Simple FAQ WordPess: Reflected Cross-Site ScriptingCVE-2021-39319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.
Product
duoFAQ - Responsive, Flat, Simple FAQ WordPess
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update duoFAQ - Responsive, Flat, Simple FAQ WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2021Flat Preloader: Does not escape some of its settingsCVE-2021-24789 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Flat Preloader
Fixed in
1.5.5
What to do
Update Flat Preloader to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Flat Preloader: Does not enforce nonce checksCVE-2021-24685 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)
Product
Flat Preloader
Fixed in
1.5.4
What to do
Update Flat Preloader to 1.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.