Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Oct 14, 2026WP Encryption: Does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routineCVE-2026-108064 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.
- Product
- WP Encryption
- Fixed in
- 7.8.8.2
- What to do
- Update WP Encryption to 7.8.8.2 or newer.
Jul 13, 2026Envision Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-builder allows DOM-Based XSS.This issue affects Envision Page Builder: from n/a through <= 0.22.
- Product
- Envision Page Builder
- Affected
- up to 0.22
- What to do
- Affects up to 0.22. Update Envision Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026WP Document Revisions: Missing AuthorizationCVE-2026-42677 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Ben Balter WP Document Revisions allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Document Revisions: from n/a before 4.0.0.
- Product
- WP Document Revisions
- Fixed in
- 4.0.0
- What to do
- Update WP Document Revisions to 4.0.0 or newer.
Mar 25, 2026PublishPress Revisions: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32539 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through <= 3.7.23.
- Product
- PublishPress Revisions
- Affected
- up to 3.7.23
- What to do
- Affects up to 3.7.23. Update PublishPress Revisions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Visionary Core: Deserialization of Untrusted DataCVE-2026-24981 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.
- Product
- Visionary Core
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Visionary Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Visionary Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24980 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Visionary Core noo-visionary-core allows Reflected XSS.This issue affects Visionary Core: from n/a through <= 1.4.9.
- Product
- Visionary Core
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Visionary Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Revision Manager TMC: Cross-Site Request Forgery (CSRF)CVE-2026-25411 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22.
- Product
- Revision Manager TMC
- Affected
- up to 2.8.22
- What to do
- Affects up to 2.8.22. Update Revision Manager TMC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026PublishPress Revisions: Cross-Site Request Forgery (CSRF)CVE-2026-25322 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PublishPress PublishPress Revisions revisionary allows Cross Site Request Forgery.This issue affects PublishPress Revisions: from n/a through <= 3.7.22.
- Product
- PublishPress Revisions
- Affected
- up to 3.7.22
- What to do
- Affects up to 3.7.22. Update PublishPress Revisions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Document Revisions: Missing AuthorizationCVE-2025-68585 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Ben Balter WP Document Revisions wp-document-revisions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Document Revisions: from n/a through <= 3.7.2.
- Product
- WP Document Revisions
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update WP Document Revisions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Revision Diet: Cross-Site Request Forgery (CSRF)CVE-2025-39419 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in David Miller Revision Diet revision-diet allows Stored XSS.This issue affects Revision Diet: from n/a through <= 1.0.1.
- Product
- Revision Diet
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Revision Diet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Delete Post Revision: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31454 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Delete Post Revision delete-post-revision allows Reflected XSS.This issue affects Delete Post Revision: from n/a through <= 1.1.
- Product
- Delete Post Revision
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Delete Post Revision to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Realtyna Provisioning: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning realtyna-provisioning allows Reflected XSS.This issue affects Realtyna Provisioning: from n/a through <= 1.2.2.
- Product
- Realtyna Provisioning
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Realtyna Provisioning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024WP Revisions Manager: Cross-Site Request Forgery (CSRF)CVE-2024-53761 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in P Roy WP Revisions Manager wp-revisions-manager allows Cross Site Request Forgery.This issue affects WP Revisions Manager: from n/a through <= 1.0.2.
- Product
- WP Revisions Manager
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Revisions Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Sensitive Information ExposureCVE-2024-11154 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Affected
- up to 3.5.15
- What to do
- Affects up to 3.5.15. Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 11, 2024PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Reflected Cross-Site ScriptingCVE-2024-9436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Affected
- up to 3.5.14
- What to do
- Affects up to 3.5.14. Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2024Revision Manager TMC: Unauthorized arbitrary email sendingCVE-2024-7622 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the _a_ajaxQuickEmailTestCallback() function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to send emails with arbitrary content to any individual through the vulnerable web server.
- Product
- Revision Manager TMC
- Affected
- up to 2.8.19
- What to do
- Affects up to 2.8.19. Update Revision Manager TMC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2024Vision Interactive: Missing AuthorizationCVE-2024-32779 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Avirtum Vision Interactive.This issue affects Vision Interactive: from n/a through 1.7.1.
- Product
- Vision Interactive
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Vision Interactive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 29, 2024Simple Revisions Delete: Cross-Site Request Forgery (CSRF)CVE-2024-30482 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brice CAPOBIANCO Simple Revisions Delete.This issue affects Simple Revisions Delete: from n/a through 1.5.3.
- Product
- Simple Revisions Delete
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Simple Revisions Delete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Delete Post Revisions In: Cross-Site Request Forgery (CSRF)CVE-2023-48754 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wap Nepal Delete Post Revisions In WordPress allows Cross Site Request Forgery.This issue affects Delete Post Revisions In WordPress: from n/a through 4.6.
- Product
- Delete Post Revisions In
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update Delete Post Revisions In to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin <= 5.1 versions.CVE-2023-25980 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin <= 5.1 versions.
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 6, 2023eVision Responsive Column Layout Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0064 · WordPress plugins & themes · reported by WPScanMedium 5.4
The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- eVision Responsive Column Layout Shortcodes
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update eVision Responsive Column Layout Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.CVE-2023-25066 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.
- Affected
- up to 7.5.30.7212
- What to do
- Affects up to 7.5.30.7212. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 9, 2023Vision Interactive For: Does not sanitise and escape some of its settingsCVE-2022-4391 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Vision Interactive For
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Vision Interactive For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2022Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at WordPress.CVE-2022-37412 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at WordPress.
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 8, 2022WooCommerce Green Wallet Gateway: Does not escape the error_envision query parameter before outputting it to the pageCVE-2022-1673 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability.
- Product
- WooCommerce Green Wallet Gateway
- Fixed in
- 1.0.2
- What to do
- Update WooCommerce Green Wallet Gateway to 1.0.2 or newer.
Aug 22, 2019The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.CVE-2016-10928 · WordPress plugins & themes · reported by MITREHigh 7.5
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
- Product
- onelogin-saml-sso
- Fixed in
- 2.2.0
- What to do
- Update onelogin-saml-sso to 2.2.0 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Jul 17, 2019A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress.CVE-2019-13573 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
- Product
- A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player
- Fixed in
- 7.3.19.727
- What to do
- Update A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player to 7.3.19.727 or newer.
Full record and what to do →NVD recordfortiguard.complugins.trac.wordpress.org
Jun 29, 2016WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/inCVE-2016-5835 · WordPress plugins & themes · reported by security@debian.orgHigh 7.5
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
- Fixed in
- 4.5.3
- What to do
- Update the plugin to 4.5.3 or newer.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.