Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
984 results · page 11 of 20
Dec 6, 2025All-in-One Video Gallery: Arbitrary file uploadsCVE-2025-12966 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory() function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- All-in-One Video Gallery
- Affected
- 4.5.4 to 4.5.7
- What to do
- Affects 4.5.4 to 4.5.7. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2025Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters: Authorization bypassCVE-2025-13309 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers with subscriber-level access and above to modify the plugin’s global accessibility settings.
- Product
- Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 4, 2025Backup, Restore and Migrate your sites with XCloner: Cross-Site Request ForgeryCVE-2025-11759 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.2. This is due to missing or incorrect nonce validation on the Xcloner_Remote_Storage:save() function. This makes it possible for unauthenticated attackers to add or modify an FTP backup configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows an attacker to set an attacker-controlled FTP site for backup storage and exfiltrate potentially sensitive site data.
- Product
- Backup, Restore and Migrate your sites with XCloner
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Backup, Restore and Migrate your sites with XCloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 22, 2025OneClick Chat to Order: Insecure Direct Object ReferenceCVE-2025-13526 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The OneClick Chat to Order plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.8 via the 'wa_order_thank_you_override' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view sensitive customer information including names, email addresses, phone numbers, billing/shipping addresses, order contents, and payment methods by simply changing the order ID in the URL.
- Product
- OneClick Chat to Order
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update OneClick Chat to Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2025Coil Web Monetization: Cross-Site Request ForgeryCVE-2025-9625 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the coil-get-css-selector parameter handling in the maybe_restrict_content function. This makes it possible for unauthenticated attackers to trigger CSS selector detection functionality via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Coil Web Monetization
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Coil Web Monetization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2025WP Dropzone: Authenticated arbitrary file uploadCVE-2025-12775 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the `ajax_upload_handle` function. This is due to the chunked upload functionality writing files directly to the uploads directory before any file type validation occurs. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WP Dropzone
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WP Dropzone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2025Project Honey Pot Spam Trap: Cross-Site Request ForgeryCVE-2025-12406 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Project Honey Pot Spam Trap
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Project Honey Pot Spam Trap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2025VK All in One Expansion Unit: Stored Cross-Site ScriptingCVE-2025-11267 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_veu_custom_css' parameter in all versions up to, and including, 9.112.1. This is due to insufficient input sanitization and output escaping on the user-supplied Custom CSS value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.
- Product
- VK All in One Expansion Unit
- Affected
- up to 9.112.1
- What to do
- Affects up to 9.112.1. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2025VK All in One Expansion Unit: Stored Cross-Site ScriptingCVE-2025-11265 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' parameters in all versions up to, and including, 9.112.1. This is due to a logic error in the CTA save function that reads sanitization callbacks from the wrong variable ($custom_field_name instead of $custom_field_options), causing the sanitization to never be applied. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute when a user accesses an injected page.",
- Product
- VK All in One Expansion Unit
- Affected
- up to 9.112.1
- What to do
- Affects up to 9.112.1. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2025All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic: Unauthorized arbitrary media attachment deletionCVE-2025-12847 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint `/wp-json/aioseo/v1/ai/image-generator` only verifying that users have the `edit_posts` capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs.
- Product
- All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
- Affected
- up to 4.8.9
- What to do
- Affects up to 4.8.9. Update All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2025All In One Login: Authentication Bypass by SpoofingCVE-2025-58595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in Saad Iqbal All In One Login change-wp-admin-login allows Identity Spoofing.This issue affects All In One Login: from n/a through <= 2.0.8.
- Product
- All In One Login
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update All In One Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Blanka - One Page: Path Traversal: '.../...//'CVE-2025-48090 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through < 1.5.
- Product
- Blanka - One Page
- What to do
- Update Blanka - One Page to the newest version.
Nov 4, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor): Local File InclusionCVE-2025-12493 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor)
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 4, 2025Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: Unauthorized modification of dataCVE-2025-12156 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_post_data() function in versions 2.0.7 to 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create and publish arbitrary posts.
- Product
- Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
- Affected
- 2.0.7 to 2.2.6
- What to do
- Affects 2.0.7 to 2.2.6. Update Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 4, 2025All in One Time Clock Lite: Unauthorized accessCVE-2025-11758 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check without capability checks. This makes it possible for unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules).
- Product
- All in One Time Clock Lite
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update All in One Time Clock Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2025ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Unauthorized modification of dataCVE-2025-11888 · WordPress plugins & themes · reported by WordfenceLow 2.7
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.
- Product
- ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
- Affected
- up to 4.8.4
- What to do
- Affects up to 4.8.4. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution: Stored Cross-Site ScriptingCVE-2025-11823 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_exist_text' parameter in the 'wishsuite_button' shortcode in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2025One Page Express Companion: Missing AuthorizationCVE-2025-62052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through <= 1.6.43.
- Product
- One Page Express Companion
- Affected
- up to 1.6.43
- What to do
- Affects up to 1.6.43. Update One Page Express Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Alone: Improper Control of Generation of Code ('Code Injection')CVE-2025-60206 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through <= 7.8.3.
- Product
- Alone
- Affected
- up to 7.8.3
- What to do
- Affects up to 7.8.3. Update Alone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MultiSite Clone Duplicator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Globalis MultiSite Clone Duplicator multisite-clone-duplicator allows Reflected XSS.This issue affects MultiSite Clone Duplicator: from n/a through <= 1.5.3.
- Product
- MultiSite Clone Duplicator
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update MultiSite Clone Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier: Insecure Direct Object ReferenceCVE-2025-6833 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber access and above, to clock other users in and out.
- Product
- All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 10, 2025Booking Manager: Registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privilegesCVE-2025-10124 · WordPress plugins & themes · reported by WPScanMedium 4.5
The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.
- Product
- Booking Manager
- Fixed in
- 2.1.15
- What to do
- Update Booking Manager to 2.1.15 or newer.
Oct 3, 2025Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: SQL InjectionCVE-2025-9200 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments() function in all versions up to, and including, 0.8.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App
- Affected
- up to 0.8.8.8
- What to do
- Affects up to 0.8.8.8. Update Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Sep 30, 2025All in One Music Player: Path TraversalCVE-2025-8559 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The All in One Music Player plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.1 via the 'theme' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of files on the server, which can contain sensitive information.
- Product
- All in One Music Player
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update All in One Music Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Sep 26, 2025AllInOne - Banner Rotator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60110 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows SQL Injection.This issue affects AllInOne - Banner Rotator: from n/a through <= 3.8.
- Product
- AllInOne - Banner Rotator
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update AllInOne - Banner Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025LambertGroup - AllInOne - Content Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60109 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Content Slider
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025LambertGroup - AllInOne - Banner with Thumbnails: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60108 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Banner with Thumbnails
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025LambertGroup - AllInOne - Banner with Playlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60107 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Banner with Playlist
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Backuply – Backup, Restore, Migrate and Clone: Arbitrary file deletionCVE-2025-10307 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Backuply – Backup, Restore, Migrate and Clone
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 26, 2025ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Unauthorized accessCVE-2025-10173 · WordPress plugins & themes · reported by WordfenceLow 2.7
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings.
- Product
- ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 22, 2025All In One SEO Pack: Missing AuthorizationCVE-2025-58650 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.
- Product
- All In One SEO Pack
- Affected
- up to 4.8.7.1
- What to do
- Affects up to 4.8.7.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025All In One SEO Pack: Insertion of Sensitive Information Into Sent DataCVE-2025-58649 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.
- Product
- All In One SEO Pack
- Affected
- up to 4.8.7.1
- What to do
- Affects up to 4.8.7.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025immonex Kickstart Team: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-57925 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart Team immonex-kickstart-team allows PHP Local File Inclusion.This issue affects immonex Kickstart Team: from n/a through <= 1.6.9.
- Product
- immonex Kickstart Team
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update immonex Kickstart Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2025All in one Minifier: SQL InjectionCVE-2025-9073 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- All in one Minifier
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update All in one Minifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 11, 2025Propovoice: All-in-One Client Management System: Arbitrary File ReadCVE-2025-8422 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Propovoice: All-in-One Client Management System
- Affected
- up to 1.7.6.7
- What to do
- Affects up to 1.7.6.7. Update Propovoice: All-in-One Client Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2025Search Cloud One: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58883 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Harris Search Cloud One search-cloud-one allows Stored XSS.This issue affects Search Cloud One: from n/a through <= 2.2.5.
- Product
- Search Cloud One
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update Search Cloud One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025AP HoneyPot: Improper Neutralization of Formula Elements in a CSV FileCVE-2025-58855 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.This issue affects AP HoneyPot WordPress Plugin: from n/a through <= 1.4.
- Product
- AP HoneyPot
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update AP HoneyPot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: Server-Side Request Forgery (SSRF)CVE-2025-58829 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Server Side Request Forgery.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.3.3.
- Product
- Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Payoneer Checkout: Missing AuthorizationCVE-2025-58795 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from n/a through <= 3.4.0.
- Product
- Payoneer Checkout
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Payoneer Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025OceanWP: Is vulnerable to an option update due to a missing capability check on one of its AJAX request handlerCVE-2025-8944 · WordPress plugins & themes · reported by WPScanMedium 4.3
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
- Product
- OceanWP
- Fixed in
- 4.1.2
- What to do
- Update OceanWP to 4.1.2 or newer.
Sep 3, 2025immonex Kickstart: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58637 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart immonex-kickstart allows PHP Local File Inclusion.This issue affects immonex Kickstart: from n/a through <= 1.11.6.
- Product
- immonex Kickstart
- Affected
- up to 1.11.6
- What to do
- Affects up to 1.11.6. Update immonex Kickstart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2025Amministrazione Trasparente: Stored Cross-Site ScriptingCVE-2025-5083 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Amministrazione Trasparente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Amministrazione Trasparente
- Affected
- up to 9.0
- What to do
- Affects up to 9.0. Update Amministrazione Trasparente to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2025Login with phone number: Missing AuthorizationCVE-2024-32832 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
- Product
- Login with phone number
- Affected
- up to 1.6.93
- What to do
- Affects up to 1.6.93. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2025All-in-One WP Migration and Backup: Stored Cross-Site ScriptingCVE-2025-8490 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- All-in-One WP Migration and Backup
- Affected
- up to 7.97
- What to do
- Affects up to 7.97. Update All-in-One WP Migration and Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 20, 2025Alone: Improper Control of Generation of Code ('Code Injection')CVE-2025-54019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through < 7.8.5.
- Product
- Alone
- What to do
- Update Alone to the newest version.
Aug 14, 2025WooCommerce OTP Login With Phone Number, OTP Verification: Authentication bypassCVE-2025-8342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
- Product
- WooCommerce OTP Login With Phone Number, OTP Verification
- Affected
- up to 1.8.47
- What to do
- Affects up to 1.8.47. Update WooCommerce OTP Login With Phone Number, OTP Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 2, 2025All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier: Reflected Cross-Site ScriptingCVE-2025-6832 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 1, 2025BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript: Arbitrary file uploadsCVE-2025-7443 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
- Affected
- up to 2.2.42
- What to do
- Affects up to 2.2.42. Update BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 15, 2025Alone – Charity Multipurpose Non-profit: Arbitrary file uploadsCVE-2025-5394 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. CVE-2025-54019 is likely a duplicate of this.
- Product
- Alone – Charity Multipurpose Non-profit
- Affected
- up to 7.8.3
- What to do
- Affects up to 7.8.3. Update Alone – Charity Multipurpose Non-profit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jul 15, 2025Alone – Charity Multipurpose Non-profit: Arbitrary file deletionCVE-2025-5393 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This was partially patched in 7.8.5 and has been fully addresses in 7.8.7.
- Product
- Alone – Charity Multipurpose Non-profit
- Affected
- up to 7.8.5
- What to do
- Affects up to 7.8.5. Update Alone – Charity Multipurpose Non-profit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.