Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39 results
Sep 7, 2026Flamingo: Authorization bypassCVE-2026-12853 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate taxonomy terms including channel names derived from Contact Form 7 form titles that may reveal internal form purposes, department names, or workflow identifiers, as well as submission counts per channel and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to Flamingo's admin UI but does not extend to WordPress core APIs such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search.
- Product
- Flamingo
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Flamingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 15, 2026Quotes llama: Does not properly sanitize and escape a user-supplied parameter before using it in a SQL queryCVE-2026-12512 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.
- Product
- Quotes llama
- Fixed in
- 3.1.6
- What to do
- Update Quotes llama to 3.1.6 or newer.
Jun 26, 2026Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.CVE-2026-56062 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 6, 2026Klamra Paycal for Aspaclaria: Insecure Direct Object ReferenceCVE-2026-8611 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'invoice_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to download arbitrary customer invoices by enumerating sequential post IDs, exposing sensitive billing PII including full name, email address, phone number, order total, line items, and customer notes belonging to other customers.
- Product
- Klamra Paycal for Aspaclaria
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Klamra Paycal for Aspaclaria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 27, 2026Islamic Database: Stored Cross-Site ScriptingCVE-2026-8845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within the islamicDB_sc_quran_qari_roqya() function, which are concatenated directly into HTML iframe attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Islamic Database
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Islamic Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 5, 2026LambertGroup - AllInOne - Banner with Playlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28110 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Banner with Playlist
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026LambertGroup - AllInOne - Content Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28109 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Reflected XSS.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Content Slider
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026LambertGroup - AllInOne - Banner with Thumbnails: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28108 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Banner with Thumbnails
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Flaming Password Reset: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68875 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jcaruso001 Flaming Password Reset flaming-password-reset allows Stored XSS.This issue affects Flaming Password Reset: from n/a through <= 1.0.3.
- Product
- Flaming Password Reset
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Flaming Password Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025GlamChic: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49941 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes GlamChic glamchic allows PHP Local File Inclusion.This issue affects GlamChic: from n/a through <= 1.0.11.
- Product
- GlamChic
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update GlamChic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Islamic Phrases: Stored Cross-Site ScriptingCVE-2025-11768 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Islamic Phrases plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phrases' shortcode attribute in all versions up to, and including, 2.12.2015. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Islamic Phrases
- Affected
- up to 2.12.2015
- What to do
- Affects up to 2.12.2015. Update Islamic Phrases to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 26, 2025LambertGroup - AllInOne - Content Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60109 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Content Slider
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025LambertGroup - AllInOne - Banner with Thumbnails: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60108 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Banner with Thumbnails
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025LambertGroup - AllInOne - Banner with Playlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60107 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Banner with Playlist
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025Glamer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53216 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeuniver Glamer glamer allows PHP Local File Inclusion.This issue affects Glamer: from n/a through <= 1.0.2.
- Product
- Glamer
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Glamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Libro de Reclamaciones y Quejas: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30989 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas libro-de-reclamaciones-y-quejas allows SQL Injection.This issue affects Libro de Reclamaciones y Quejas: from n/a through <= 0.9.
- Product
- Libro de Reclamaciones y Quejas
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Libro de Reclamaciones y Quejas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Libro de Reclamaciones: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46446 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanrojas Libro de Reclamaciones libro-de-reclamaciones allows Stored XSS.This issue affects Libro de Reclamaciones: from n/a through <= 1.0.1.
- Product
- Libro de Reclamaciones
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Libro de Reclamaciones to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Libro de Reclamaciones y Quejas: Cross-Site Request Forgery (CSRF)CVE-2025-32113 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas libro-de-reclamaciones-y-quejas allows Cross Site Request Forgery.This issue affects Libro de Reclamaciones y Quejas: from n/a through <= 1.0.
- Product
- Libro de Reclamaciones y Quejas
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Libro de Reclamaciones y Quejas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Quotes llama: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30786 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.This issue affects Quotes llama: from n/a through <= 3.1.0.
- Product
- Quotes llama
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Quotes llama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Quotes llama: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27307 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows Reflected XSS.This issue affects Quotes llama: from n/a through <= 3.0.1.
- Product
- Quotes llama
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Quotes llama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Aklamator INfeed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12731 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Aklamator INfeed
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Aklamator INfeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Aklamator INfeed: Does not sanitise and escape some of its settingsCVE-2024-12717 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Aklamator INfeed
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Aklamator INfeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Flaming Forms: Cross-Site Request Forgery (CSRF)CVE-2024-54398 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jcaruso001 Flaming Forms flaming-forms allows Stored XSS.This issue affects Flaming Forms: from n/a through <= 1.0.1.
- Product
- Flaming Forms
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024TM Islamic Helper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52458 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zaymund TM Islamic Helper tm-islamic-helper allows Reflected XSS.This issue affects TM Islamic Helper: from n/a through <= 1.0.1.
- Product
- TM Islamic Helper
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update TM Islamic Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 22, 2024Quotes llama: Stored Cross-Site ScriptingCVE-2024-10874 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Quotes llama plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quotes-llama' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Quotes llama
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Quotes llama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 2, 2024Flaming Forms: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-7692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Flaming Forms
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2024Flaming Forms: Does not sanitise and escape some parametersCVE-2024-7691 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators.
- Product
- Flaming Forms
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 1, 2024WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature.CVE-2024-45270 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.
- Fixed in
- 2.2.4
- What to do
- Update the plugin to 2.2.4 or newer.
Sep 1, 2024WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature.CVE-2024-45269 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.
- Fixed in
- 2.0
- What to do
- Update the plugin to 2.0 or newer.
Aug 21, 2024Flamix: Bitrix24 and Contact Form 7 integrations: Full Path DisclosureCVE-2024-6568 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Flamix: Bitrix24 and Contact Form 7 integrations
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Flamix: Bitrix24 and Contact Form 7 integrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 29, 2024Absolutely Glamorous Custom Admin: Server-Side Request Forgery (SSRF)CVE-2024-33627 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Cusmin Absolutely Glamorous Custom Admin.This issue affects Absolutely Glamorous Custom Admin: from n/a through 7.2.2.
- Product
- Absolutely Glamorous Custom Admin
- Affected
- up to 7.2.2
- What to do
- Affects up to 7.2.2. Update Absolutely Glamorous Custom Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 19, 2024WP Calameo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29098 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calameo WP Calameo allows Stored XSS.This issue affects WP Calameo: from n/a through 2.1.7.
- Product
- WP Calameo
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update WP Calameo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2024Advanced Flamingo: Cross-Site Request Forgery (CSRF)CVE-2023-52226 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.
- Product
- Advanced Flamingo
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Advanced Flamingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.CVE-2023-47813 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin <= 1.4.14.3 versions.CVE-2023-46087 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin <= 1.4.14.3 versions.
- Affected
- up to 1.4.14.3
- What to do
- Affects up to 1.4.14.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 30, 2022Quotes llama: Does not sanitise and escape QuotesCVE-2022-1566 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file
- Product
- Quotes llama
- Fixed in
- 1.0.0
- What to do
- Update Quotes llama to 1.0.0 or newer.
Sep 23, 2021AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-36823 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) allows Stored XSS.This issue affects AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): from n/a through 6.8.
- Product
- AGCA - Absolutely Glamorous Custom Admin (WordPress plugin)
- Affected
- up to 6.8
- What to do
- Affects up to 6.8. Update AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 10, 2021MoolaMojo: Reflected Cross-Site ScriptingCVE-2021-38358 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1.
- Product
- MoolaMojo
- Affected
- up to 0.7.4.1
- What to do
- Affects up to 0.7.4.1. Update MoolaMojo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 14, 2021When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitisedCVE-2021-24341 · WordPress plugins & themes · reported by WPScanHigh 8.8
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
- Product
- Xllentech English Islamic Calendar
- Fixed in
- 2.6.8
- What to do
- Update Xllentech English Islamic Calendar to 2.6.8 or newer.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.