Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

20 results

Sep 1, 2026BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot: Stored Cross-Site ScriptingCVE-2026-75980 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives wp_kses_post because entity-encoded quotes in a heading id attribute are treated as a single legitimate attribute value at save time; the dangerous payload only materialises after process_content_for_toc() calls html_entity_decode() on the stored content and the broken id is extracted by a lazy regex before being echoed unescaped into the Table of Contents output.
Product
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot: Generic SQL InjectionCVE-2026-15104 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a supported multilingual plugin (WPML, Polylang, qTranslate, Weglot, or TranslatePress) to be active on the site, as the vulnerable code path is gated by Helper::is_multilingual_active().
Product
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Stored Cross-Site ScriptingCVE-2026-12734 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Stored Cross-Site ScriptingCVE-2026-12731 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Missing AuthorizationCVE-2026-12729 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a missing capability check on the do_migration() function registered as the wedocs_migrate_betterdocs_to_wedocs AJAX action, which performs no nonce verification via check_ajax_referer() and no capability check via current_user_can() before executing sensitive operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full BetterDocs-to-weDocs data migration, creating and modifying 'docs' custom post type entries with attacker-controlled titles, updating site options, and deactivating the BetterDocs and BetterDocs Pro plugins via deactivate_plugins().
Product
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Wikilookup: Stored Cross-Site ScriptingCVE-2026-3354 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Wikilookup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Popup Width' setting in all versions up to, and including, 1.1.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Wikilookup
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Wikilookup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2026Wikiloops Track Player: Stored Cross-Site ScriptingCVE-2026-1611 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wikiloops Track Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wikiloops` shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wikiloops Track Player
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Wikiloops Track Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 23, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Unauthorized modification or loss of dataCVE-2025-13921 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data due to a missing capability check on the 'wedocs_user_documentation_handling_capabilities' function in all versions up to, and including, 2.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit any documentation post. The vulnerability was partially patched in version 2.1.16.
Product
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
Affected
up to 2.1.16
What to do
Affects up to 2.1.16. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 31, 2025Knowledge Base documentation & wiki plugin – BasePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62761 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BasePress Knowledge Base documentation & wiki plugin – BasePress basepress allows Stored XSS.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through <= 2.17.0.1.
Product
Knowledge Base documentation & wiki plugin – BasePress
Affected
up to 2.17.0.1
What to do
Affects up to 2.17.0.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025Yada Wiki: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66094 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dmccan Yada Wiki yada-wiki allows Stored XSS.This issue affects Yada Wiki: from n/a through <= 3.5.
Product
Yada Wiki
Affected
up to 3.5
What to do
Affects up to 3.5. Update Yada Wiki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Wikipedia Preview: Missing AuthorizationCVE-2025-52738 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.
Product
Wikipedia Preview
Affected
up to 1.15.0
What to do
Affects up to 1.15.0. Update Wikipedia Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Wiki Embed: Cross-Site Request Forgery (CSRF)CVE-2025-47551 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ctltwp Wiki Embed wiki-embed allows Cross Site Request Forgery.This issue affects Wiki Embed: from n/a through <= 1.4.6.
Product
Wiki Embed
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Wiki Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025RDP Wiki Embed: Cross-Site Request Forgery (CSRF)CVE-2025-32262 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Robert D Payne RDP Wiki Embed rdp-wiki-embed allows Cross Site Request Forgery.This issue affects RDP Wiki Embed: from n/a through <= 1.2.20.
Product
RDP Wiki Embed
Affected
up to 1.2.20
What to do
Affects up to 1.2.20. Update RDP Wiki Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2025WP Wiki Tooltip: Stored Cross-Site ScriptingCVE-2024-13462 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Wiki Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wiki' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Wiki Tooltip
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update WP Wiki Tooltip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 4, 2024Knowledge Base documentation & wiki plugin – BasePress Docs: Unauthorized modification of dataCVE-2024-10664 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the basepress_db_posts_update() function in all versions up to, and including, 2.16.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the database.
Product
Knowledge Base documentation & wiki plugin – BasePress Docs
Affected
up to 2.16.3.3
What to do
Affects up to 2.16.3.3. Update Knowledge Base documentation & wiki plugin – BasePress Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 17, 2024Encyclopedia / Glossary / Wiki: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49320 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dennis Encyclopedia / Glossary / Wiki encyclopedia-lexicon-glossary-wiki-dictionary allows Reflected XSS.This issue affects Encyclopedia / Glossary / Wiki: from n/a through <= 1.7.60.
Product
Encyclopedia / Glossary / Wiki
Affected
up to 1.7.60
What to do
Affects up to 1.7.60. Update Encyclopedia / Glossary / Wiki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 29, 2024Knowledge Base documentation & wiki plugin – BasePress: Missing AuthorizationCVE-2024-33588 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
Product
Knowledge Base documentation & wiki plugin – BasePress
Affected
up to 2.16.1
What to do
Affects up to 2.16.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Knowledge Base documentation & wiki plugin – BasePress: Server-Side Request Forgery (SSRF)CVE-2024-33590 · WordPress plugins & themes · reported by PatchstackMedium 5
Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
Product
Knowledge Base documentation & wiki plugin – BasePress
Affected
up to 2.16.1
What to do
Affects up to 2.16.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 2, 2021Yada Wiki: Did not sanitiseCVE-2021-24470 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Yada Wiki WordPress plugin before 3.4.1 did not sanitise, validate or escape the anchor attribute of its shortcode, leading to a Stored Cross-Site Scripting issue
Product
Yada Wiki
Fixed in
3.4.1
What to do
Update Yada Wiki to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web scCVE-2014-4575 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Product
Wikipop
Affected
up to 2.0
What to do
Affects up to 2.0. Update Wikipop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.