Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
May 23, 2025Solid Mail – SMTP email and logging made by SolidWP: Stored Cross-Site ScriptingCVE-2025-1123 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Solid Mail – SMTP email and logging made by SolidWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email Name, Subject, and Body in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Solid Mail – SMTP email and logging made by SolidWP
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Solid Mail – SMTP email and logging made by SolidWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 10, 2025WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages: Processes user-supplied inputCVE-2024-13896 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression via the wp_geshi_filter_replace_code() function, which could lead to Regular Expression Denial of Service (ReDoS) issue
- Product
- WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Solidres: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13329 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Solidres
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Solidres – Hotel booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23911 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in solidres Solidres – Hotel booking plugin solidres allows SQL Injection.This issue affects Solidres – Hotel booking plugin: from n/a through <= 0.9.4.
- Product
- Solidres – Hotel booking
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Solidres – Hotel booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024Solid Security: Use of Less Trusted SourceCVE-2022-44593 · WordPress plugins & themes · reported by PatchstackLow 3.7
Use of Less Trusted Source vulnerability in SolidWP Solid Security allows HTTP DoS.This issue affects Solid Security: from n/a through 9.3.1.
- Product
- Solid Security
- Affected
- up to 9.3.1
- What to do
- Affects up to 9.3.1. Update Solid Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024Solid Affiliate: Insertion of Sensitive Information into Log FileCVE-2024-33637 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information into Log File vulnerability in Solid Plugins Solid Affiliate.This issue affects Solid Affiliate: from n/a through 1.9.1.
- Product
- Solid Affiliate
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Solid Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Solid Security – Password, Two Factor Authentication, and Brute Force Protection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-28786 · WordPress plugins & themes · reported by PatchstackLow 3.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.
- Product
- Solid Security – Password, Two Factor Authentication, and Brute Force Protection
- Affected
- up to 8.1.4
- What to do
- Affects up to 8.1.4. Update Solid Security – Password, Two Factor Authentication, and Brute Force Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 3, 2023Solidres: Does not sanitise and escape numerous parameter before outputting them back in pagesCVE-2023-1377 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Solidres
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2023Solidres: Stored Cross-Site ScriptingCVE-2023-1374 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Solidres
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddanielkelley.meplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.