Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Aug 19, 2026Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode.CVE-2026-64851 · WordPress plugins & themes · reported by GitHubHigh 8.5
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
- Fixed in
- 6.2.2
- What to do
- Update the plugin to 6.2.2 or newer.
Sep 10, 2025MyBrain Utilities: Stored Cross-Site ScriptingCVE-2025-10126 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' shortcode in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MyBrain Utilities
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update MyBrain Utilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2025Nepali Date Utilities: Cross-Site Request Forgery (CSRF)CVE-2025-32664 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ashokbasnet Nepali Date Utilities nepali-date-utilities allows Stored XSS.This issue affects Nepali Date Utilities: from n/a through <= 1.0.15.
- Product
- Nepali Date Utilities
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update Nepali Date Utilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 18, 2025Utilities for MTG: Stored Cross-Site ScriptingCVE-2024-13433 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Utilities for MTG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Utilities for MTG
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Utilities for MTG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Sep 28, 2024WP MultiTasking – WP Utilities: Stored Cross-Site ScriptingCVE-2024-8189 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP MultiTasking – WP Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpmt_menu_name’ parameter in all versions up to, and including, 0.1.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- WP MultiTasking – WP Utilities
- Affected
- up to 0.1.17
- What to do
- Affects up to 0.1.17. Update WP MultiTasking – WP Utilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2024Contact Form 7: Has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosingCVE-2024-4704 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing.
- Product
- Contact Form 7
- Fixed in
- 5.9.5
- What to do
- Update Contact Form 7 to 5.9.5 or newer.
Jun 5, 2024Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'impoCVE-2024-5324 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2022Transposh WordPress Translation: Exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/adminCVE-2022-25810 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and backup/restore operations.
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 2, 2020WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.CVE-2020-28032 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 17, 2020Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php.CVE-2020-6850 · WordPress plugins & themes · reported by MITREMedium 6.1
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.
- Product
- Utilities.php in the miniorange-saml-20-single-sign-on
- Fixed in
- 4.8.84
- What to do
- Update Utilities.php in the miniorange-saml-20-single-sign-on to 4.8.84 or newer.
Full record and what to do →NVD recordwordpress.orgzeroauth.ltd
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.