Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

64 results · page 1 of 2

Sep 17, 2026The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output esCVE-2026-92991 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 1, 2026Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient inpuCVE-2024-13362 · WordPress plugins & themes · reported by WordfenceMedium 6.1
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2026All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions.CVE-2026-6443 · WordPress plugins & themes · reported by WordfenceCritical 9.8
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record anchor.host wordfence.com
Nov 20, 2025Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various vCVE-2025-5092 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 13, 2025Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions.CVE-2025-0818 · WordPress plugins & themes · reported by WordfenceMedium 6.5
Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Aug 5, 2025Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emCVE-2025-8420 · WordPress plugins & themes · reported by WordfenceHigh 8.1
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versiCVE-2025-2537 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library (version 3.1.6) in various versions duCVE-2025-2540 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library (version 3.1.6) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versionCVE-2024-5647 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 26, 2024Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient inpuCVE-2024-11202 · WordPress plugins & themes · reported by WordfenceMedium 6.1
Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions.CVE-2024-8725 · WordPress plugins & themes · reported by WordfenceMedium 6.8
Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files to any directory within the WordPress root directory, which could lead to Stored Cross-Site Scripting. The Advanced File Manager Shortcodes plugin must be installed to exploit this vulnerability.
Fixed in
5.2.9
What to do
Update the plugin to 5.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in various AJAX actionsCVE-2024-1747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
Product
WooCommerce Customers Manager
Fixed in
30.2
What to do
Update WooCommerce Customers Manager to 30.2 or newer.
Full record and what to do →NVD record wpscan.com
Jun 25, 2024WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and outpuCVE-2024-6307 · WordPress plugins & themes · reported by WordfenceMedium 6.4
WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
May 21, 2024Sailthru Triggermail: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-4289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Sailthru Triggermail
Affected
up to 1.1
What to do
Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 3, 2024WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outpuCVE-2024-4439 · WordPress plugins & themes · reported by WordfenceHigh 7.2
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
May 3, 2024Gutenverse: Does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embedCVE-2024-3692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenverse
Fixed in
1.9.1
What to do
Update Gutenverse to 1.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2024WooCommerce Customers Manager: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-1743 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WooCommerce Customers Manager
Fixed in
29.8
What to do
Update WooCommerce Customers Manager to 29.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2024Enjoy Social Feed plugin for WordPress website: Does not have authorisation and CSRF in various function hooked to admin_initCVE-2024-0779 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example
Product
Enjoy Social Feed plugin for WordPress website
Affected
up to 6.2.2
What to do
Affects up to 6.2.2. Update Enjoy Social Feed plugin for WordPress website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2024Smart Forms: Does not have authorisation in various AJAX actionsCVE-2023-7203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.
Product
Smart Forms
Fixed in
2.6.87
What to do
Update Smart Forms to 2.6.87 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Community by PeepSo: Does not sanitise and escape various parameters and generated URLs before outputting them back attributesCVE-2024-0187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Community by PeepSo
Fixed in
6.3.1.2
What to do
Update Community by PeepSo to 6.3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024Estatik Real Estate: Does not sanitise and escape various parameters and generated URLs before outputting them back in attributesCVE-2023-6050 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Estatik Real Estate
Fixed in
4.1.1
What to do
Update Estatik Real Estate to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023POEditor: Does not have CSRF checks in various placesCVE-2023-4209 · WordPress plugins & themes · reported by WPScanMedium 4.3
The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as reset the plugin's settings and update its API key via CSRF attacks.
Product
POEditor
Fixed in
0.9.8
What to do
Update POEditor to 0.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not sanitise and escape various parameters before outputting it back in the pageCVE-2023-3671 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
MultiParcels Shipping For WooCommerce
Fixed in
1.15.4
What to do
Update MultiParcels Shipping For WooCommerce to 1.15.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitizCVE-2023-3708 · WordPress plugins & themes · reported by WordfenceMedium 6.1
Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record deothemes.com themes.trac.wordpress.org
Jun 27, 2023KiviCare: Does not have CSRF checks (either flawed or missing completely) in various AJAX actionsCVE-2023-2628 · WordPress plugins & themes · reported by WPScanHigh 8.8
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)
Product
KiviCare
Fixed in
3.2.1
What to do
Update KiviCare to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023KiviCare: Does not have proper CSRF and authorisation checks in various AJAX actionsCVE-2023-2627 · WordPress plugins & themes · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings
Product
KiviCare
Fixed in
3.2.1
What to do
Update KiviCare to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023Accordion & FAQ: Does not escape various generated URLsCVE-2023-1891 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting
Product
Accordion & FAQ
Fixed in
1.9.9
What to do
Update Accordion & FAQ to 1.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2023
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Tablesome: Does not escape various generated URLsCVE-2023-1890 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting
Product
Tablesome
Fixed in
1.0.9
What to do
Update Tablesome to 1.0.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 15, 2023Push Notifications for WordPress by PushAssist: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-0644 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Push Notifications for WordPress by PushAssist
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Push Notifications for WordPress by PushAssist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023Ajax Search Pro: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-1435 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ajax Search Pro
Fixed in
4.26.2
What to do
Update Ajax Search Pro to 4.26.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023WP VR: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2023-1414 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours
Product
WP VR
Fixed in
8.3.0
What to do
Update WP VR to 8.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023BackupBuddy: Does not sanitise and escape some parameters before outputting them back in various placesCVE-2022-4897 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting
Product
BackupBuddy
Fixed in
8.8.3
What to do
Update BackupBuddy to 8.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Simple URLs: Does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated usersCVE-2023-0098 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
Product
Simple URLs
Fixed in
115
What to do
Update Simple URLs to 115 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated usersCVE-2022-4237 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
Product
Welcart e-Commerce
Fixed in
2.8.6
What to do
Update Welcart e-Commerce to 2.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various functions used to update the plugin settingsCVE-2022-3805 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
Product
Jeg Elementor Kit
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various AJAX actionsCVE-2022-3794 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.
Product
Jeg Elementor Kit
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 14, 2022reSmush.it : the only free Image Optimizer & compress: Lacks authorization in various AJAX actionsCVE-2022-2450 · WordPress plugins & themes · reported by WPScanMedium 4.3
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
Product
reSmush.it : the only free Image Optimizer & compress
Fixed in
0.4.4
What to do
Update reSmush.it : the only free Image Optimizer & compress to 0.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
Product
Zephyr Project Manager
Fixed in
3.2.5
What to do
Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jul 17, 2022Insights from Google PageSpeed: Does not verify for CSRF before doing various actions suchCVE-2022-1672 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks
Product
Insights from Google PageSpeed
Fixed in
4.0.7
What to do
Update Insights from Google PageSpeed to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2022WP Championship: Is lacking CSRF checks in various placesCVE-2022-1967 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
Product
WP Championship
Fixed in
9.3
What to do
Update WP Championship to 9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022WP Post Styling: Does not have CSRF checks in various actionsCVE-2022-1845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks
Product
WP Post Styling
Fixed in
1.3.1
What to do
Update WP Post Styling to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022MailPress: Does not have CSRF checks in various placesCVE-2022-1843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks
Product
MailPress
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update MailPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022Note Press: Does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboardCVE-2022-1688 · WordPress plugins & themes · reported by WPScanLow 2.7
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections
Product
Note Press
Affected
up to 0.1.10
What to do
Affects up to 0.1.10. Update Note Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jun 8, 2022Cube Slider: Does not sanitise and escape the idslider parameter before using it in various SQL queriesCVE-2022-1684 · WordPress plugins & themes · reported by WPScanLow 2.7
The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin
Product
Cube Slider
Affected
up to 1.2
What to do
Affects up to 1.2. Update Cube Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
May 30, 2022Content Mask: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2022-1203 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
Product
Content Mask
Fixed in
1.8.4.1
What to do
Update Content Mask to 1.8.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not escape various settings before outputting them in attributesCVE-2022-1408 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
VikBooking Hotel Booking Engine & PMS
Fixed in
1.5.8
What to do
Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Visual Slide Box Builder: Does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (suchCVE-2022-1182 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections
Product
Visual Slide Box Builder
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Visual Slide Box Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022Ubigeo de Perú para Woocommerce: Does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actionsCVE-2022-0814 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
Product
Ubigeo de Perú para Woocommerce
Fixed in
3.6.4
What to do
Update Ubigeo de Perú para Woocommerce to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022LayerSlider: Does not sanitise and escape Project's slug before outputting it back in various placeCVE-2022-1153 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
LayerSlider
Fixed in
7.1.2
What to do
Update LayerSlider to 7.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.