Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Oct 16, 2026Vitepos – Point of Sale (POS) for WooCommerce: Generic SQL InjectionCVE-2026-92766 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unauthenticated attackers, or authenticated attackers holding any POS role (such as vtpos-cashier), to exploit the vulnerability, as the /vitepos/v1/vendor/list REST route's permission callback requires only a POS role assignment rather than any elevated WordPress capability.
- Product
- Vitepos – Point of Sale (POS) for WooCommerce
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Vitepos – Point of Sale (POS) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Vitepos – Point of Sale (POS) for WooCommerce: Blind SQL InjectionCVE-2026-109414 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched.
- Product
- Vitepos – Point of Sale (POS) for WooCommerce
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Vitepos – Point of Sale (POS) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 8, 2026Vitepos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-105076 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1.
- Product
- Vitepos
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.CVE-2026-96815 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026vitepos: Does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpointsCVE-2026-14238 · WordPress plugins & themes · reported by WPScanMedium 4.1
The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.
- Product
- vitepos
- Fixed in
- 3.6.0
- What to do
- Update vitepos to 3.6.0 or newer.
Aug 10, 2026vitepos WordPress plugin before 3.6.0, Vitepos: Do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability bCVE-2026-14237 · WordPress plugins & themes · reported by WPScanHigh 7.2
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
- Product
- vitepos WordPress plugin before 3.6.0, Vitepos
- Fixed in
- 3.6.0
- What to do
- Update vitepos WordPress plugin before 3.6.0, Vitepos to 3.6.0 or newer.
Jul 13, 2026Vitepos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57385 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through <= 3.4.2.
- Product
- Vitepos
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.CVE-2026-54841 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 22, 2026Vitepos: Does not properly restrict the roles that can be assignedCVE-2026-8157 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
- Product
- Vitepos
- Fixed in
- 3.4.2
- What to do
- Update Vitepos to 3.4.2 or newer.
Dec 9, 2025Gravitec.net – Web Push Notifications: Missing AuthorizationCVE-2025-62869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gravitec.net - Web Push Notifications Gravitec.net – Web Push Notifications gravitec-net-web-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gravitec.net – Web Push Notifications: from n/a through <= 2.9.17.
- Product
- Gravitec.net – Web Push Notifications
- Affected
- up to 2.9.17
- What to do
- Affects up to 2.9.17. Update Gravitec.net – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Vitepos – Point of Sale (POS) for WooCommerce: Arbitrary file uploadsCVE-2025-13156 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible.
- Product
- Vitepos – Point of Sale (POS) for WooCommerce
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Vitepos – Point of Sale (POS) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 7, 2025WP Discord Invite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47638 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarvesh M Rao WP Discord Invite wp-discord-invite allows Stored XSS.This issue affects WP Discord Invite: from n/a through <= 2.5.3.
- Product
- WP Discord Invite
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Discord Invite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-39535 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.7.
- Product
- Vitepos
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Vite Coupon: Cross-Site Request Forgery (CSRF)CVE-2025-32642 · WordPress plugins & themes · reported by PatchstackCritical 10
Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through <= 1.0.9.
- Product
- Vite Coupon
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Vite Coupon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-22277 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.
- Product
- Vitepos
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Secure Invites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Secure Invites wordpress-mu-secure-invites allows Reflected XSS.This issue affects Secure Invites: from n/a through <= 1.3.
- Product
- Secure Invites
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Secure Invites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 22, 2025Vitepos: Missing AuthorizationCVE-2025-26750 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vitepos: from n/a through <= 3.1.3.
- Product
- Vitepos
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.CVE-2024-12015 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 7.7
The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.
- What to do
- Update the plugin to the newest version.
Aug 18, 2024Invite Anyone: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43327 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Boone Gorges Invite Anyone allows Reflected XSS.This issue affects Invite Anyone: from n/a through 1.4.7.
- Product
- Invite Anyone
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Invite Anyone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2024The lacks CSRF checks allowing a user to invite any user to any group (including private groups)CVE-2024-2232 · WordPress plugins & themes · reported by WPScanHigh 8.1
The lacks CSRF checks allowing a user to invite any user to any group (including private groups)
- Fixed in
- 2.1.3
- What to do
- Update the plugin to 2.1.3 or newer.
May 8, 2024Vitepos: Missing AuthorizationCVE-2024-33574 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1.
- Product
- Vitepos
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 17, 2024WP Discord Invite: Does not protect some of its actions against CSRF attacksCVE-2023-5006 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request.
- Product
- WP Discord Invite
- Fixed in
- 2.5.1
- What to do
- Update WP Discord Invite to 2.5.1 or newer.
Nov 6, 2023WP Discord Invite: Does not sanitise and escape some of its settingsCVE-2023-5181 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Discord Invite
- Fixed in
- 2.5.2
- What to do
- Update WP Discord Invite to 2.5.2 or newer.
Sep 10, 2021WordPress InviteBox Plugin for viral Refer-a-Friend Promotions: Reflected Cross-Site ScriptingCVE-2021-38359 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1.
- Product
- WordPress InviteBox Plugin for viral Refer-a-Friend Promotions
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WordPress InviteBox Plugin for viral Refer-a-Friend Promotions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.CVE-2017-18545 · WordPress plugins & themes · reported by MITREHigh 7.5
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
- Product
- invite-anyone
- Fixed in
- 1.3.16
- What to do
- Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.CVE-2017-18544 · WordPress plugins & themes · reported by MITREHigh 8.8
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
- Product
- invite-anyone
- Fixed in
- 1.3.16
- What to do
- Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.CVE-2017-18543 · WordPress plugins & themes · reported by MITRECritical 9.8
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
- Product
- invite-anyone
- Fixed in
- 1.3.16
- What to do
- Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 17, 2017An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress.CVE-2017-6955 · WordPress plugins & themes · reported by MITREMedium 5.3
An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack.
- Product
- An issue was discovered in by-email/by-email.php in the Invite Anyone
- Fixed in
- 1.3.15
- What to do
- Update An issue was discovered in by-email/by-email.php in the Invite Anyone to 1.3.15 or newer.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Mar 28, 2014Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium plugin before 13.04 for WordPress allows remote attackers to inject arbitrary web scrCVE-2013-2695 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium plugin before 13.04 for WordPress allows remote attackers to inject arbitrary web script or HTML via the u parameter.
- Product
- Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium
- Fixed in
- 13.04
- What to do
- Update Cross-site scripting (XSS) vulnerability in invite.php in the WP Symposium to 13.04 or newer.
Mar 28, 2014Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and coCVE-2013-2694 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 5.8
Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the u parameter.
- Product
- WP Symposium
- Affected
- 13.04 to 13.04
- What to do
- Affects 13.04 to 13.04. Update WP Symposium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 12, 2008Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parCVE-2008-1304 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite action to wp-admin/users.php and the (2) to parameter in a sent action to wp-admin/invites.php.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecurityreason.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.