Vulnerability database

3,631 results · page 13 of 73

• Jun 6, 2025HR Management Lite: Cross-Site Request Forgery (CSRF)CVE-2025-29005 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Cross Site Request Forgery.This issue affects HR Management Lite: from n/a through <= 3.6.

  Product

  HR Management Lite

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update HR Management Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Epicwin: Cross-Site Request Forgery (CSRF)CVE-2025-28986 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin epicwin-subscribers allows SQL Injection.This issue affects Epicwin Plugin: from n/a through <= 1.5.

  Product

  Epicwin

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Epicwin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Subscription Renewal Reminders for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-28984 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in storepro Subscription Renewal Reminders for WooCommerce subscriptions-renewal-reminders allows Cross Site Request Forgery.This issue affects Subscription Renewal Reminders for WooCommerce: from n/a through <= 1.4.1.

  Product

  Subscription Renewal Reminders for WooCommerce

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Subscription Renewal Reminders for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Mail Options: Cross-Site Request Forgery (CSRF)CVE-2025-28981 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Soli WP Mail Options wp-mail-options allows Stored XSS.This issue affects WP Mail Options: from n/a through <= 0.2.3.

  Product

  WP Mail Options

  Affected

  up to 0.2.3

  What to do

  Affects up to 0.2.3. Update WP Mail Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Free WP Mail SMTP: Cross-Site Request Forgery (CSRF)CVE-2025-28974 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mail250 Free WP Mail SMTP free-wp-mail-smtp allows Stored XSS.This issue affects Free WP Mail SMTP: from n/a through <= 1.0.

  Product

  Free WP Mail SMTP

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Free WP Mail SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Recent Posts Slider Responsive: Cross-Site Request Forgery (CSRF)CVE-2025-28966 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affects Recent Posts Slider Responsive: from n/a through <= 1.0.1.

  Product

  Recent Posts Slider Responsive

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Recent Posts Slider Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Personal Favicon: Cross-Site Request Forgery (CSRF)CVE-2025-28964 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a through <= 2.0.

  Product

  Personal Favicon

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Personal Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Bg Orthodox Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-28958 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov Bg Orthodox Calendar bg-orthodox-calendar allows Stored XSS.This issue affects Bg Orthodox Calendar: from n/a through <= 0.13.10.

  Product

  Bg Orthodox Calendar

  Affected

  up to 0.13.10

  What to do

  Affects up to 0.13.10. Update Bg Orthodox Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Backwp: Cross-Site Request Forgery (CSRF)CVE-2025-28954 · WordPress plugins & themes · reported by PatchstackHigh 7.4

  Cross-Site Request Forgery (CSRF) vulnerability in wphobby Backwp backwp allows Path Traversal.This issue affects Backwp: from n/a through <= 2.0.2.

  Product

  Backwp

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Backwp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025CubePoints: Cross-Site Request Forgery (CSRF)CVE-2025-28952 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Lau CubePoints cubepoints allows Cross Site Request Forgery.This issue affects CubePoints: from n/a through <= 3.2.1.

  Product

  CubePoints

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update CubePoints to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Post Author: Cross-Site Request Forgery (CSRF)CVE-2025-28950 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through <= 1.1.1.

  Product

  Post Author

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Mediabay - WordPress Media Library Folders: Cross-Site Request Forgery (CSRF)CVE-2025-28948 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.

  Product

  Mediabay - WordPress Media Library Folders

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Quick Event Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-27360 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Cross Site Request Forgery.This issue affects Quick Event Calendar: from n/a through <= 1.4.9.

  Product

  Quick Event Calendar

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update Quick Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Media File Type Manager: Cross-Site Request Forgery (CSRF)CVE-2025-27359 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Media File Type Manager wp-media-file-type-manager allows Cross Site Request Forgery.This issue affects WP Media File Type Manager: from n/a through <= 2.3.1.

  Product

  WP Media File Type Manager

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update WP Media File Type Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025FastBook: Cross-Site Request Forgery (CSRF)CVE-2025-26593 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Cross Site Request Forgery.This issue affects FastBook: from n/a through <= 1.1.

  Product

  FastBook

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update FastBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Pay with Contact Form 7: Cross-Site Request Forgery (CSRF)CVE-2025-24772 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.

  Product

  Pay with Contact Form 7

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Pay with Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Dynamic Pricing and Discount Rules: Cross-Site Request Forgery (CSRF)CVE-2025-49077 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeHigh Dynamic Pricing and Discount Rules discount-and-dynamic-pricing allows Cross Site Request Forgery.This issue affects Dynamic Pricing and Discount Rules: from n/a through <= 2.2.9.

  Product

  Dynamic Pricing and Discount Rules

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update Dynamic Pricing and Discount Rules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Real Time Validation for Gravity Forms: Cross-Site Request Forgery (CSRF)CVE-2025-48328 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.

  Product

  Real Time Validation for Gravity Forms

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Real Time Validation for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 5, 2025Element Pack Pro: Cross-Site Request Forgery (CSRF)CVE-2025-46257 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.

  Product

  Element Pack Pro

  Fixed in

  8.0.0

  What to do

  Update Element Pack Pro to 8.0.0 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jun 4, 2025File Provider: Does not have CSRF check in placeCVE-2025-4580 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

  Product

  File Provider

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update File Provider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Jun 2, 2025Contact Forms by Cimatti: Cross-Site Request Forgery (CSRF)CVE-2025-49069 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in cimatti Contact Forms by Cimatti contact-forms allows Cross Site Request Forgery.This issue affects Contact Forms by Cimatti: from n/a through <= 1.9.8.

  Product

  Contact Forms by Cimatti

  Affected

  up to 1.9.8

  What to do

  Affects up to 1.9.8. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 23, 2025occupancyplan: Cross-Site Request Forgery (CSRF)CVE-2025-46458 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Cross-Site Request Forgery (CSRF) vulnerability in x000x occupancyplan occupancyplan allows SQL Injection.This issue affects occupancyplan: from n/a through <= 1.0.3.0.

  Product

  occupancyplan

  Affected

  up to 1.0.3.0

  What to do

  Affects up to 1.0.3.0. Update occupancyplan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025User Profile Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-48340 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through <= 1.02.

  Product

  User Profile Meta Manager

  Affected

  up to 1.02

  What to do

  Affects up to 1.02. Update User Profile Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025CheckBot: Cross-Site Request Forgery (CSRF)CVE-2025-43840 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ref CheckBot checkbot allows Stored XSS.This issue affects CheckBot: from n/a through <= 1.05.

  Product

  CheckBot

  Affected

  up to 1.05

  What to do

  Affects up to 1.05. Update CheckBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025wp-cyr-cho: Cross-Site Request Forgery (CSRF)CVE-2025-43835 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ktsvetkov wp-cyr-cho wp-cyr-cho allows Cross Site Request Forgery.This issue affects wp-cyr-cho: from n/a through <= 0.1.

  Product

  wp-cyr-cho

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update wp-cyr-cho to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Salon booking system: Cross-Site Request Forgery (CSRF)CVE-2025-47583 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affects Salon booking system: from n/a through <= 10.16.

  Product

  Salon booking system

  Affected

  up to 10.16

  What to do

  Affects up to 10.16. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Easy Child Theme Creator: Cross-Site Request Forgery (CSRF)CVE-2025-39375 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Ashok G Easy Child Theme Creator easy-child-theme-creator allows Cross Site Request Forgery.This issue affects Easy Child Theme Creator: from n/a through <= 1.3.1.

  Product

  Easy Child Theme Creator

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Easy Child Theme Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Best Posts Summary: Cross-Site Request Forgery (CSRF)CVE-2025-39374 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in aseem1234 Best Posts Summary best-posts-summary allows Stored XSS.This issue affects Best Posts Summary: from n/a through <= 1.0.

  Product

  Best Posts Summary

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Best Posts Summary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Author Box Plugin With Different Description: Cross-Site Request Forgery (CSRF)CVE-2025-39371 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Author Box Plugin With Different Description author-box-with-different-description allows Cross Site Request Forgery.This issue affects Author Box Plugin With Different Description: from n/a through <= 1.3.5.

  Product

  Author Box Plugin With Different Description

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Author Box Plugin With Different Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Grand Restaurant: Cross-Site Request Forgery (CSRF)CVE-2025-39351 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Cross Site Request Forgery.This issue affects Grand Restaurant: from n/a through <= 7.0.

  Product

  Grand Restaurant

  Affected

  up to 7.0

  What to do

  Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Rootspersona: Cross-Site Request Forgery (CSRF)CVE-2025-48344 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in ed4becky Rootspersona rootspersona allows Cross Site Request Forgery.This issue affects Rootspersona: from n/a through <= 3.7.5.

  Product

  Rootspersona

  Affected

  up to 3.7.5

  What to do

  Affects up to 3.7.5. Update Rootspersona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Dynamic Pricing & Discounts Lite for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48342 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in RedefiningTheWeb Dynamic Pricing & Discounts Lite for WooCommerce woo-dynamic-pricing-discounts-lite allows Cross Site Request Forgery.This issue affects Dynamic Pricing & Discounts Lite for WooCommerce: from n/a through <= 2.0.4.

  Product

  Dynamic Pricing & Discounts Lite for WooCommerce

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Dynamic Pricing & Discounts Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Falang multilanguage: Cross-Site Request Forgery (CSRF)CVE-2025-48285 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.61.

  Product

  Falang multilanguage

  Affected

  up to 1.3.61

  What to do

  Affects up to 1.3.61. Update Falang multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Japanized For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48284 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in shohei.tanaka Japanized For WooCommerce woocommerce-for-japan allows Cross Site Request Forgery.This issue affects Japanized For WooCommerce: from n/a through <= 2.6.40.

  Product

  Japanized For WooCommerce

  Affected

  up to 2.6.40

  What to do

  Affects up to 2.6.40. Update Japanized For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Year Make Model Search for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48265 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through <= 1.0.11.

  Product

  Year Make Model Search for WooCommerce

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update Year Make Model Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Product Code for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48264 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in artiosmedia Product Code for WooCommerce product-code-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Code for WooCommerce: from n/a through <= 1.5.0.

  Product

  Product Code for WooCommerce

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Product Code for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025WP Mapa Politico España: Cross-Site Request Forgery (CSRF)CVE-2025-48259 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Juan Carlos WP Mapa Politico España wp-mapa-politico-spain allows Cross Site Request Forgery.This issue affects WP Mapa Politico España: from n/a through <= 3.8.0.

  Product

  WP Mapa Politico España

  Affected

  up to 3.8.0

  What to do

  Affects up to 3.8.0. Update WP Mapa Politico España to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Broadcast Live Video: Cross-Site Request Forgery (CSRF)CVE-2025-48255 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery.This issue affects Broadcast Live Video: from n/a through <= 6.2.4.

  Product

  Broadcast Live Video

  Affected

  up to 6.2.4

  What to do

  Affects up to 6.2.4. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025reCAPTCHA for all: Cross-Site Request Forgery (CSRF)CVE-2025-48243 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA for all: from n/a through <= 2.26.

  Product

  reCAPTCHA for all

  Affected

  up to 2.26

  What to do

  Affects up to 2.26. Update reCAPTCHA for all to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025AWcode Toolkit: Cross-Site Request Forgery (CSRF)CVE-2025-48238 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in awcode AWcode Toolkit awcode-toolkit allows Stored XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.18.

  Product

  AWcode Toolkit

  Affected

  up to 1.0.18

  What to do

  Affects up to 1.0.18. Update AWcode Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 19, 2025Affiliates Manager Google reCAPTCHA Integration: Cross-Site Request Forgery (CSRF)CVE-2025-48233 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in affmngr Affiliates Manager Google reCAPTCHA Integration affiliates-manager-google-recaptcha-integration allows Stored XSS.This issue affects Affiliates Manager Google reCAPTCHA Integration: from n/a through <= 1.0.6.

  Product

  Affiliates Manager Google reCAPTCHA Integration

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Affiliates Manager Google reCAPTCHA Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce: Have a flawed CSRF checkCVE-2022-4363 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via a CSRF attack

  Product

  Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce

  Fixed in

  2.2.2

  What to do

  Update Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce to 2.2.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• May 16, 2025SEO Flow by LupsOnline: Cross-Site Request Forgery (CSRF)CVE-2025-48146 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Michael Lups SEO Flow by LupsOnline lupsonline-link-netwerk allows Stored XSS.This issue affects SEO Flow by LupsOnline: from n/a through <= 2.2.1.

  Product

  SEO Flow by LupsOnline

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update SEO Flow by LupsOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025Import Export For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48144 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.

  Product

  Import Export For WooCommerce

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update Import Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025ValidateCertify: Cross-Site Request Forgery (CSRF)CVE-2025-48115 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through <= 1.6.4.

  Product

  ValidateCertify

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update ValidateCertify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025ShayanWeb Admin FontChanger: Cross-Site Request Forgery (CSRF)CVE-2025-48114 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shayan Farhang Pazhooh ShayanWeb Admin FontChanger shayanweb-admin-fontchanger allows Stored XSS.This issue affects ShayanWeb Admin FontChanger: from n/a through <= 1.9.1.

  Product

  ShayanWeb Admin FontChanger

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update ShayanWeb Admin FontChanger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025QuickCal - Appointment Booking Calendar for: Cross-Site Request Forgery (CSRF)CVE-2025-32310 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal - Appointment Booking Calendar for WordPress quickcal allows Privilege Escalation.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.

  Product

  QuickCal - Appointment Booking Calendar for

  Affected

  up to 1.0.15

  What to do

  Affects up to 1.0.15. Update QuickCal - Appointment Booking Calendar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025Featured Posts Scroll: Cross-Site Request Forgery (CSRF)CVE-2025-32245 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll featured-posts-scroll allows Stored XSS.This issue affects Featured Posts Scroll: from n/a through <= 1.25.

  Product

  Featured Posts Scroll

  Affected

  up to 1.25

  What to do

  Affects up to 1.25. Update Featured Posts Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025CSS3 Accordions for: Cross-Site Request Forgery (CSRF)CVE-2025-31922 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Stored XSS.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.

  Product

  CSS3 Accordions for

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update CSS3 Accordions for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• May 16, 2025WP Ultimate Tours Builder: Cross-Site Request Forgery (CSRF)CVE-2025-31921 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Ultimate Tours Builder WP_UltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through <= 1.055.

  Product

  WP Ultimate Tours Builder

  Affected

  up to 1.055

  What to do

  Affects up to 1.055. Update WP Ultimate Tours Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.