Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,153 results · page 10 of 24
Jun 14, 2025Restrict File Access: Directory TraversalCVE-2025-6070 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Restrict File Access
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Restrict File Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2025WP Pipes: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48267 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP Pipes: from n/a through 1.4.2.
- Product
- WP Pipes
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spice Blocks: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48130 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.
- Product
- Spice Blocks
- Affected
- up to 2.0.7.4
- What to do
- Affects up to 2.0.7.4. Update Spice Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48124 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Path Traversal.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Welcart e-Commerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47511 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through <= 2.11.13.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.13
- What to do
- Affects up to 2.11.13. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Seofy Core: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-39473 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebGeniusLab Seofy Core seofy-core allows PHP Local File Inclusion.This issue affects Seofy Core: from n/a through <= 1.6.8.
- Product
- Seofy Core
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update Seofy Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025SUMO Affiliates Pro: Unrestricted Upload of File with Dangerous TypeCVE-2025-32291 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through < 11.1.0.
- Product
- SUMO Affiliates Pro
- What to do
- Update SUMO Affiliates Pro to the newest version.
Jun 9, 2025CLEVER: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31635 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup CLEVER lbg-audio11-html5-shoutcast_history allows Path Traversal.This issue affects CLEVER: from n/a through <= 2.6.
- Product
- CLEVER
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update CLEVER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Apptha Slider Gallery: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31050 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appthaplugins Apptha Slider Gallery apptha-slider-gallery allows Path Traversal.This issue affects Apptha Slider Gallery: from n/a through <= 2.5.
- Product
- Apptha Slider Gallery
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Apptha Slider Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Category Icon: Improper Restriction of XML External Entity ReferenceCVE-2025-31039 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through <= 1.0.3.
- Product
- Category Icon
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Category Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Store Locator: Unrestricted Upload of File with Dangerous TypeCVE-2025-49329 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Upload a Web Shell to a Web Server.This issue affects Store Locator WordPress: from n/a through <= 1.5.2.
- Product
- Store Locator
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2025Simple Page Access Restriction: Cross-Site Request ForgeryCVE-2025-5142 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for unauthenticated attackers to (1) enable or disable access protection on all post types or taxonomies, (2) force every new page/post to be public or private, regardless of meta-box settings, (3) cause a silent wipe of all plugin data when it’s later removed, or (4) to conduct URL redirection attacks via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Simple Page Access Restriction
- Affected
- up to 1.0.31
- What to do
- Affects up to 1.0.31. Update Simple Page Access Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 23, 2025WP Job Portal: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48273 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Path Traversal.This issue affects WP Job Portal: from n/a through <= 2.3.2.
- Product
- WP Job Portal
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025StoreKeeper for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-47687 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.
- Product
- StoreKeeper for WooCommerce
- Affected
- up to 14.4.4
- What to do
- Affects up to 14.4.4. Update StoreKeeper for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Hospital Management System: Unrestricted Upload of File with Dangerous TypeCVE-2025-47663 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System allows Upload a Web Shell to a Web Server. This issue affects Hospital Management System: from 47.0(20 through 11.
- Product
- Hospital Management System
- Affected
- up to 11
- What to do
- Affects up to 11. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025ELEX WordPress HelpDesk & Customer Ticketing System: Unrestricted Upload of File with Dangerous TypeCVE-2025-47658 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Upload a Web Shell to a Web Server.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through <= 3.2.9.
- Product
- ELEX WordPress HelpDesk & Customer Ticketing System
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Ajar in5 Embed: Unrestricted Upload of File with Dangerous TypeCVE-2025-47642 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through <= 3.1.5.
- Product
- Ajar in5 Embed
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Ajar in5 Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Printcart Web to Print Product Designer for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-47641 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Upload a Web Shell to a Web Server.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.3.9.
- Product
- Printcart Web to Print Product Designer for WooCommerce
- Affected
- up to 2.3.9
- What to do
- Affects up to 2.3.9. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025STAGGS: Unrestricted Upload of File with Dangerous TypeCVE-2025-47637 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in STAGGS STAGGS staggs allows Upload a Web Shell to a Web Server.This issue affects STAGGS: from n/a through <= 2.11.0.
- Product
- STAGGS
- Affected
- up to 2.11.0
- What to do
- Affects up to 2.11.0. Update STAGGS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025belingoGeo: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47603 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Belingo belingoGeo belingogeo allows Path Traversal.This issue affects belingoGeo: from n/a through <= 1.12.0.
- Product
- belingoGeo
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update belingoGeo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Opal Woo Custom Product Variation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47535 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through <= 1.2.0.
- Product
- Opal Woo Custom Product Variation
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Opal Woo Custom Product Variation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Infocob CRM Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47513 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in James Laforge Infocob CRM Forms infocob-crm-forms allows Path Traversal.This issue affects Infocob CRM Forms: from n/a through <= 2.4.0.
- Product
- Infocob CRM Forms
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Infocob CRM Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Tainacan: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47512 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tainacan Tainacan tainacan allows Path Traversal.This issue affects Tainacan: from n/a through <= 0.21.14.
- Product
- Tainacan
- Affected
- up to 0.21.14
- What to do
- Affects up to 0.21.14. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Drag and Drop File Upload for Elementor Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47492 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Path Traversal.This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through <= 1.4.3.
- Product
- Drag and Drop File Upload for Elementor Forms
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Drag and Drop File Upload for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Web3Press: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LikeCoin Web3Press likecoin allows Path Traversal.This issue affects Web3Press: from n/a through <= 3.2.0.
- Product
- Web3Press
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Web3Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Crossword Compiler Puzzles: Unrestricted Upload of File with Dangerous TypeCVE-2025-46490 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Upload a Web Shell to a Web Server.This issue affects Crossword Compiler Puzzles: from n/a through <= 5.2.
- Product
- Crossword Compiler Puzzles
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Crossword Compiler Puzzles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46486 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.7.
- Product
- Nomupay Payment Processing Gateway
- Affected
- up to 7.1.7
- What to do
- Affects up to 7.1.7. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025JP Students Result Management System Premium: Unrestricted Upload of File with Dangerous TypeCVE-2025-31916 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Server. This issue affects JP Students Result Management System Premium: from 1.1.7 through n/a.
- Product
- JP Students Result Management System Premium
- What to do
- Update JP Students Result Management System Premium to the newest version.
May 23, 2025KBx Pro Ultimate: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31053 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Path Traversal.This issue affects KBx Pro Ultimate: from n/a through < 8.0.5.
- Product
- KBx Pro Ultimate
- What to do
- Update KBx Pro Ultimate to the newest version.
May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39402 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39401 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Hospital Management System: Unrestricted Upload of File with Dangerous TypeCVE-2025-39380 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System hospital-management allows Upload a Web Shell to a Web Server.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
- Product
- Hospital Management System
- Affected
- up to 47.0
- What to do
- Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Grand Restaurant: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32926 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects Grand Restaurant: from n/a through <= 7.0.
- Product
- Grand Restaurant
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025TI WooCommerce Wishlist: Unrestricted Upload of File with Dangerous TypeCVE-2025-47577 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.
- Product
- TI WooCommerce Wishlist
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Celestial Aura: Unrestricted Upload of File with Dangerous TypeCVE-2025-26892 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/a through 2.2.
- Product
- Celestial Aura
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Celestial Aura to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Eximius: Unrestricted Upload of File with Dangerous TypeCVE-2025-26872 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue affects Eximius: from n/a through 2.2.
- Product
- Eximius
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Eximius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Secure Downloads: Is vulnerable does not properly restrictCVE-2024-8031 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php.
- Product
- Secure Downloads
- Fixed in
- 1.2.3
- What to do
- Update Secure Downloads to 1.2.3 or newer.
May 7, 2025Instantio: Unrestricted Upload of File with Dangerous TypeCVE-2025-47550 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a Web Shell to a Web Server.This issue affects Instantio: from n/a through <= 3.3.16.
- Product
- Instantio
- Affected
- up to 3.3.16
- What to do
- Affects up to 3.3.16. Update Instantio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025BEAF: Unrestricted Upload of File with Dangerous TypeCVE-2025-47549 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through <= 4.6.10.
- Product
- BEAF
- Affected
- up to 4.6.10
- What to do
- Affects up to 4.6.10. Update BEAF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025Slider & Popup Builder by Depicter: Generic SQL InjectionCVE-2025-2011 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Slider & Popup Builder by Depicter
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Slider & Popup Builder by Depicter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 24, 2025PowerPress Podcasting: Unrestricted Upload of File with Dangerous TypeCVE-2025-46264 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue affects PowerPress Podcasting: from n/a through <= 11.12.5.
- Product
- PowerPress Podcasting
- Affected
- up to 11.12.5
- What to do
- Affects up to 11.12.5. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025StoreContrl Woocommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-39568 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arture B.V. StoreContrl Woocommerce storecontrl-wp-connection allows Path Traversal.This issue affects StoreContrl Woocommerce: from n/a through <= 4.1.3.
- Product
- StoreContrl Woocommerce
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update StoreContrl Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025I Draw: Unrestricted Upload of File with Dangerous TypeCVE-2025-39436 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through <= 1.0.
- Product
- I Draw
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update I Draw to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025MapSVG: Unrestricted Upload of File with Dangerous TypeCVE-2025-32682 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through <= 8.6.4.
- Product
- MapSVG
- Affected
- up to 8.6.4
- What to do
- Affects up to 8.6.4. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025JS Job Manager: Unrestricted Upload of File with Dangerous TypeCVE-2025-32660 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in JoomSky JS Job Manager js-jobs allows Upload a Web Shell to a Web Server.This issue affects JS Job Manager: from n/a through <= 2.0.2.
- Product
- JS Job Manager
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Restrict User Registration: Cross-Site Request Forgery (CSRF)CVE-2025-32655 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DevriX Restrict User Registration restrict-user-registration allows Stored XSS.This issue affects Restrict User Registration: from n/a through <= 1.0.1.
- Product
- Restrict User Registration
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Restrict User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Solace Extra: Unrestricted Upload of File with Dangerous TypeCVE-2025-32652 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in solacewp Solace Extra solace-extra allows Using Malicious Files.This issue affects Solace Extra: from n/a through <= 1.3.1.
- Product
- Solace Extra
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Solace Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025MyTicket Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-27299 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Asia MyTicket Events myticket-events allows Path Traversal.This issue affects MyTicket Events: from n/a through <= 1.2.4.
- Product
- MyTicket Events
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update MyTicket Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Restrict Taxonomies: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antoine Guillien Restrict Taxonomies restrict-taxonomies allows Reflected XSS.This issue affects Restrict Taxonomies: from n/a through <= 1.3.3.
- Product
- Restrict Taxonomies
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Restrict Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Theme File Duplicator: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-27283 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rockgod100 Theme File Duplicator theme-file-duplicator allows Path Traversal.This issue affects Theme File Duplicator: from n/a through <= 1.3.
- Product
- Theme File Duplicator
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Theme File Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.