Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

47 results

Oct 16, 2026YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports: Arbitrary File UploadCVE-2026-92553 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable extensions and no allow-list, MIME check, or safe-extension rename is applied. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The only server-side guard is a .htaccess file containing 'Require all denied' written by writeGuards(), which is silently ignored by nginx and by Apache configured with AllowOverride None, meaning RCE is fully achievable on those server configurations.
Product
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 6, 2026Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored Cross-Site ScriptingCVE-2026-75962 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable without authentication on WordPress Multisite installations with public registration enabled, as WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, persisting the attacker-controlled address verbatim to the email log via the failed-send exception message.
Product
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2026JetBackup: Does not perform its multisite authorisation check before serving backup archives and job logsCVE-2026-19454 · WordPress plugins & themes · reported by WPScanMedium 4.4
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
Product
JetBackup
Fixed in
3.1.23.5
What to do
Update JetBackup to 3.1.23.5 or newer.
Full record and what to do →NVD record wpscan.com
Jun 22, 2026Transbank Webpay: Does not sanitize and escape logs to be displayedCVE-2026-6858 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator
Product
Transbank Webpay
Fixed in
1.14.0
What to do
Update Transbank Webpay to 1.14.0 or newer.
Full record and what to do →NVD record wpscan.com hackedalert.com
Jun 6, 2026Debug Log Manager – Conveniently Monitor and Inspect Errors: Improper Output Neutralization for LogsCVE-2026-9016 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions up to, and including, 2.5.0. This is due to the `log_js_errors()` AJAX handler being registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and gated only by a nonce that is publicly disclosed in every front-end page's HTML through `wp_localize_script()` whenever JavaScript error logging is enabled, providing no real authorization barrier. This makes it possible for unauthenticated attackers to inject arbitrary forged entries into the site's WordPress debug log by supplying attacker-controlled values for the `message`, `script`, `lineNo`, `columnNo`, and `pageUrl` fields — enabling spoofing of error and incident records, obscuring malicious activity within fabricated log noise, and misleading administrators who rely on the log for triage. This vulnerability is only exploitable when the plugin's JavaScript error logging feature is enabled, as the requisite nonce is only published into the page HTML under that condition.
Product
Debug Log Manager – Conveniently Monitor and Inspect Errors
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Debug Log Manager – Conveniently Monitor and Inspect Errors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 1, 2026Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: Insertion of Sensitive Information Into Sent DataCVE-2026-42673 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: from n/a through 3.3.6.
Product
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 9, 2026Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: Authentication Bypass to Information DisclosureCVE-2026-8198 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an Authorization header skip Bearer token validation and fall through to an unconditional return true statement, bypassing all authentication checks. This makes it possible for unauthenticated attackers to access the /wp-json/logtivity/v1/options REST API endpoint and retrieve all plugin configuration options, including the logtivity_site_api_key which can be used to impersonate the site in API calls to the Logtivity service.
Product
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 18, 2026Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored Cross-Site ScriptingCVE-2026-3090 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_type’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when the Post SMTP Pro plugin is also installed and its Reporting and Tracking extension is enabled.
Product
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026WPBlogSyn: Cross-Site Request ForgeryCVE-2025-14389 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's remote sync settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WPBlogSyn
Affected
up to 1.0
What to do
Affects up to 1.0. Update WPBlogSyn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2025Divelogs Widget: Stored Cross-Site ScriptingCVE-2025-13962 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divelogs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'latestdive' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Divelogs Widget
Affected
up to 1.5
What to do
Affects up to 1.5. Update Divelogs Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2025SureMail – SMTP and Email Logs: Unrestricted Upload of File with Dangerous TypeCVE-2025-13516 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's save_file() function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessible directory (wp-content/uploads/suremails/attachments/) without validating file extensions or content types. Files are saved with predictable names derived from MD5 hashes of their content. While the plugin attempts to protect this directory with an Apache .htaccess file to disable PHP execution, this protection is ineffective on nginx, IIS, and Lighttpd servers, or on misconfigured Apache installations. This makes it possible for unauthenticated attackers to achieve Remote Code Execution by uploading malicious PHP files through any public form that emails attachments, calculating the predictable filename, and directly accessing the file to execute arbitrary code granted they are exploiting a site running on an affected web server configuration.
Product
SureMail – SMTP and Email Logs
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update SureMail – SMTP and Email Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org plugins.trac.wordpress.org
Nov 1, 2025Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App: Unauthorized access of dataCVE-2025-11833 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
Product
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025Video Blogster Lite: Cross-Site Request Forgery (CSRF)CVE-2025-60132 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Stored XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2.
Product
Video Blogster Lite
Affected
up to 1.2
What to do
Affects up to 1.2. Update Video Blogster Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin forCVE-2025-9219 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions.
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2025Video Blogster Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47689 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Reflected XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2.
Product
Video Blogster Lite
Affected
up to 1.2
What to do
Affects up to 1.2. Update Video Blogster Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2025The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site ImportsCVE-2025-4684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.2.13.1
What to do
Affects up to 3.2.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 15, 2025Connexion Logs: Does not have CSRF check in placeCVE-2024-11373 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Connexion Logs
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Connexion Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Connexion Logs: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Connexion Logs
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Connexion Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 19, 2025YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service: Stored Cross-Site ScriptingCVE-2025-0916 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 2.4.9 to 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: The vulnerability has been initially patched in version 2.4.8 and was reintroduced in version 2.4.9 with the removal of the wp_kses_post() built-in WordPress sanitization function.
Product
YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service
Affected
2.4.9 to 2.6.2
What to do
Affects 2.4.9 to 2.6.2. Update YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 23, 2024Easy Liveblogs: Stored Cross-Site ScriptingCVE-2024-11387 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Liveblogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elb_liveblog' shortcode in all versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Liveblogs
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Easy Liveblogs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2024The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress isCVE-2024-11104 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the save_options() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. Please note this is limited to option values that can be saved as arrays.
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site ImportsCVE-2024-8325 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the ‘blockspare_render_social_sharing_block’ function in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 21, 2024WP Logs Book: Does not sanitise and escape some of its log data before outputting them back in an admin dashboardCVE-2024-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting
Product
WP Logs Book
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024WP Logs Book: Does not have CSRF checkCVE-2024-4475 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in admin clear the logs them via a CSRF attack
Product
WP Logs Book
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024WP Logs Book: Does not have CSRF check in placeCVE-2024-4474 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP Logs Book
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2024Backup Bolt: Is vulnerable to Information Exposure via the unprotected access of debug logsCVE-2023-7236 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system errors which could contain sensitive information.
Product
Backup Bolt
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Backup Bolt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024WP Blogs' Planetarium: Does not have CSRF check in placeCVE-2023-6532 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP Blogs' Planetarium
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Blogs' Planetarium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Dec 18, 2023Redirect 404 Error Page to Homepage or Custom Page with Logs: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47530 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7.
Product
Redirect 404 Error Page to Homepage or Custom Page with Logs
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update Redirect 404 Error Page to Homepage or Custom Page with Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Quttera Web Malware Scanner: Doesn't restrict access to detailed scan logsCVE-2023-6065 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code
Product
Quttera Web Malware Scanner
Fixed in
3.4.2.1
What to do
Update Quttera Web Malware Scanner to 3.4.2.1 or newer.
Full record and what to do →NVD record drive.google.com wpscan.com
Oct 18, 2023MpOperationLogs: Stored Cross-Site ScriptingCVE-2023-5538 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MpOperationLogs
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update MpOperationLogs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 16, 2023User Activity Log Pro: Does not properly escape recorded User-Agents in the user activity logs dashboardCVE-2023-5167 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks.
Product
User Activity Log Pro
Fixed in
2.3.4
What to do
Update User Activity Log Pro to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Active Directory Integration / LDAP Integration: Stores sensitive LDAP logs in a buffer fileCVE-2023-5003 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.
Product
Active Directory Integration / LDAP Integration
Fixed in
4.1.10
What to do
Update Active Directory Integration / LDAP Integration to 4.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Autoptimize: Uses an easily guessable path to store plugin's exported settings and logsCVE-2022-4057 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
Product
Autoptimize
Fixed in
3.1.0
What to do
Update Autoptimize to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 17, 2022Helpful: Puts the exported logs and feedbacks in a publicly accessible location and guessable namesCVE-2022-2834 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin's settings
Product
Helpful
Fixed in
4.5.26
What to do
Update Helpful to 4.5.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Easy Digital Downloads: Does not sanitise and escape the Downloadable File Name in the LogsCVE-2022-0706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Product
Easy Digital Downloads
Fixed in
2.11.6
What to do
Update Easy Digital Downloads to 2.11.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 28, 2022Block Bad Bots: Does not properly sanitise and escape the User Agent before using it in a SQL statement to record logsCVE-2021-25070 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue
Product
Block Bad Bots
Fixed in
6.88
What to do
Update Block Bad Bots to 6.88 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Better WordPress Google XML Sitemaps: Does not sanitise and escape its logsCVE-2022-0230 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
Product
Better WordPress Google XML Sitemaps
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Better WordPress Google XML Sitemaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Redirect 404 Error Page to Homepage or Custom Page with Logs: Does not check for CSRFCVE-2021-24767 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
Product
Redirect 404 Error Page to Homepage or Custom Page with Logs
Fixed in
1.7.9
What to do
Update Redirect 404 Error Page to Homepage or Custom Page with Logs to 1.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Simple Download Monitor: Saves logs in a predictable locationCVE-2021-24695 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
Product
Simple Download Monitor
Fixed in
3.9.6
What to do
Update Simple Download Monitor to 3.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 30, 2020There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needCVE-2020-21524 · WordPress plugins & themes · reported by MITRECritical 9.1
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 22, 2018The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.CVE-2018-12636 · WordPress plugins & themes · reported by MITREHigh 7.2
The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.
Product
iThemes Security (better-wp-security)
Fixed in
7.0.3
What to do
Update iThemes Security (better-wp-security) to 7.0.3 or newer.
Full record and what to do →NVD record lists.apache.org wordpress.org
Mar 2, 2018The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.CVE-2018-7433 · WordPress plugins & themes · reported by MITREHigh 7.5
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.
Product
iThemes Security
Fixed in
6.9.1
What to do
Update iThemes Security to 6.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers to inject arbitrary wCVE-2014-4848 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bs_blog_id parameter to wp-admin/options-general.php.
Product
Blogstand Banner (blogstand-smart-banner)
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Blogstand Banner (blogstand-smart-banner) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in get.php in the WP Microblogs plugin 0.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web CVE-2014-4590 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in get.php in the WP Microblogs plugin 0.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the oauth_verifier parameter.
Product
WP Microblogs
Affected
up to 0.4.0
What to do
Affects up to 0.4.0. Update WP Microblogs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in admin/admin_show_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows remote attackers to inCVE-2014-4582 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/admin_show_dialogs.php in the WP Consultant plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the dialog_id parameter.
Product
WP Consultant
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Consultant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 23, 2012wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for: Cross-site scripting (XSS)CVE-2011-5104 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are obtained from third party information.
Product
wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for
What to do
Update wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for to the newest version.
Full record and what to do →NVD record osvdb.org plugins.trac.wordpress.org
Oct 22, 2008wp-admin/wp-blogs.php in Wordpress MU: Cross-site scripting (XSS)CVE-2008-4671 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) s and (2) ip_address parameters.
Product
wp-admin/wp-blogs.php in Wordpress MU
Fixed in
2.6
What to do
Update wp-admin/wp-blogs.php in Wordpress MU to 2.6 or newer.
Full record and what to do →NVD record lists.grok.org.uk secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.