Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,181 results · page 14 of 24
May 16, 2025TNC FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39509 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook pdf-viewer-for-wordpress allows Stored XSS.This issue affects TNC FlipBook: from n/a through <= 12.1.0.
- Product
- TNC FlipBook
- Affected
- up to 12.1.0
- What to do
- Affects up to 12.1.0. Update TNC FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025QuickCal - Appointment Booking Calendar for: Cross-Site Request Forgery (CSRF)CVE-2025-32310 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal - Appointment Booking Calendar for WordPress quickcal allows Privilege Escalation.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.
- Product
- QuickCal - Appointment Booking Calendar for
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update QuickCal - Appointment Booking Calendar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025QuickCal - Appointment Booking Calendar for: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32299 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress quickcal allows Retrieve Embedded Sensitive Data.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.
- Product
- QuickCal - Appointment Booking Calendar for
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update QuickCal - Appointment Booking Calendar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Salon Booking Pro: Missing AuthorizationCVE-2025-32295 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through <= 10.10.2.
- Product
- Salon Booking Pro
- Affected
- up to 10.10.2
- What to do
- Affects up to 10.10.2. Update Salon Booking Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses: Does not sanitise and escape some of its settingsCVE-2024-9882 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses
- Fixed in
- 1.9.4
- What to do
- Update Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses to 1.9.4 or newer.
May 15, 2025Free Booking Plugin for Hotels, Restaurants and Car Rentals: Does not have CSRF check in placeCVE-2024-9450 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack
- Product
- Free Booking Plugin for Hotels, Restaurants and Car Rentals
- Fixed in
- 1.3.15
- What to do
- Update Free Booking Plugin for Hotels, Restaurants and Car Rentals to 1.3.15 or newer.
May 15, 2025VikBooking Hotel Booking Engine & PMS: Does not sanitise and escape some of its settingsCVE-2024-13616 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.7.2
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.7.2 or newer.
May 14, 2025LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2025-3769 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.1.92
- What to do
- Affects up to 5.1.92. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 8, 2025WPBookit: Privilege escalationCVE-2025-3811 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email through the edit_newdata_customer_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- WPBookit
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 8, 2025WPBookit: Privilege escalationCVE-2025-3810 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password and email through the edit_profile_data() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account.
- Product
- WPBookit
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 7, 2025RS WP Book Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47679 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RS WP THEMES RS WP Book Showcase rs-wp-books-showcase allows DOM-Based XSS.This issue affects RS WP Book Showcase: from n/a through <= 6.7.59.
- Product
- RS WP Book Showcase
- Affected
- up to 6.7.59
- What to do
- Affects up to 6.7.59. Update RS WP Book Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Ebook Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47589 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allows DOM-Based XSS.This issue affects Ebook Store: from n/a through <= 5.8009.
- Product
- Ebook Store
- Affected
- up to 5.8009
- What to do
- Affects up to 5.8009. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025TrueBooker: Cross-Site Request Forgery (CSRF)CVE-2025-47543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Cross Site Request Forgery.This issue affects TrueBooker: from n/a through <= 1.0.7.
- Product
- TrueBooker
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Hotel Booking: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47498 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.6.
- Product
- Hotel Booking
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Beds24 Online Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47489 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through <= 2.0.29.
- Product
- Beds24 Online Booking
- Affected
- up to 2.0.29
- What to do
- Affects up to 2.0.29. Update Beds24 Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Hotel Booking: Cross-Site Request Forgery (CSRF)CVE-2025-47448 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Booking: from n/a through <= 2.1.9.
- Product
- WP Hotel Booking
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2025The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation inCVE-2025-2470 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability.
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Apr 24, 2025Booking and Rental Manager: Missing AuthorizationCVE-2025-39390 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking and Rental Manager: from n/a through <= 2.3.6.
- Product
- Booking and Rental Manager
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025Appointment Booking Calendar: Missing AuthorizationCVE-2025-46247 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.
- Product
- Appointment Booking Calendar
- Affected
- up to 1.3.92
- What to do
- Affects up to 1.3.92. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025Appointment Booking Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-46241 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.
- Product
- Appointment Booking Calendar
- Affected
- up to 1.3.92
- What to do
- Affects up to 1.3.92. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Hotel Booking: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39526 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.6.
- Product
- Hotel Booking
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Booking and Rental Manager: Missing AuthorizationCVE-2025-39457 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.2.8.
- Product
- Booking and Rental Manager
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WP Social Bookmarking: Cross-Site Request Forgery (CSRF)CVE-2025-39422 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in PResponsive WP Social Bookmarking wp-social-bookmarking allows Stored XSS.This issue affects WP Social Bookmarking: from n/a through <= 3.6.
- Product
- WP Social Bookmarking
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update WP Social Bookmarking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025TuriTop Booking System: Deserialization of Untrusted DataCVE-2025-32571 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Object Injection.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.
- Product
- TuriTop Booking System
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update TuriTop Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Course Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32508 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ComMotion Course Booking System course-booking-system allows Reflected XSS.This issue affects Course Booking System: from n/a through <= 6.1.2.
- Product
- Course Booking System
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update Course Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Booking Ultra Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27345 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Reflected XSS.This issue affects Booking Ultra Pro: from n/a through <= 1.1.19.
- Product
- Booking Ultra Pro
- Affected
- up to 1.1.19
- What to do
- Affects up to 1.1.19. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Integration for WooCommerce and QuickBooks: Cross-Site Request Forgery (CSRF)CVE-2025-39600 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for WooCommerce and QuickBooks wp-woocommerce-quickbooks allows Cross Site Request Forgery.This issue affects Integration for WooCommerce and QuickBooks: from n/a through <= 1.3.1.
- Product
- Integration for WooCommerce and QuickBooks
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Integration for WooCommerce and QuickBooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025MyBookProgress by Stormhill Media: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30982 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookProgress by Stormhill Media mybookprogress allows Stored XSS.This issue affects MyBookProgress by Stormhill Media: from n/a through <= 1.0.8.
- Product
- MyBookProgress by Stormhill Media
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update MyBookProgress by Stormhill Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Booking and Rental Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-27011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows PHP Local File Inclusion.This issue affects Booking and Rental Manager: from n/a through <= 2.2.8.
- Product
- Booking and Rental Manager
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025WpBookingly: Deserialization of Untrusted DataCVE-2025-32607 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpBookingly service-booking-manager allows Object Injection.This issue affects WpBookingly: from n/a through <= 1.3.0.
- Product
- WpBookingly
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update WpBookingly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025MyWorks WooCommerce Sync for QuickBooks Online: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32524 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyWorks MyWorks WooCommerce Sync for QuickBooks Online myworks-woo-sync-for-quickbooks-online allows Reflected XSS.This issue affects MyWorks WooCommerce Sync for QuickBooks Online: from n/a through <= 2.9.1.
- Product
- MyWorks WooCommerce Sync for QuickBooks Online
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update MyWorks WooCommerce Sync for QuickBooks Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Social Bookmarking RELOADED: Cross-Site Request Forgery (CSRF)CVE-2025-31393 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in vfvalent Social Bookmarking RELOADED social-bookmarking-reloaded allows Stored XSS.This issue affects Social Bookmarking RELOADED: from n/a through <= 3.18.
- Product
- Social Bookmarking RELOADED
- Affected
- up to 3.18
- What to do
- Affects up to 3.18. Update Social Bookmarking RELOADED to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Freetobook Responsive Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32273 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in freetobook Freetobook Responsive Widget freetobook-responsive-widget allows Cross Site Request Forgery.This issue affects Freetobook Responsive Widget: from n/a through <= 1.1.
- Product
- Freetobook Responsive Widget
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Freetobook Responsive Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025WPBookit: Missing AuthorizationCVE-2025-32254 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iqonic Design WPBookit wpbookit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPBookit: from n/a through <= 1.0.7.
- Product
- WPBookit
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Course Booking System: Missing AuthorizationCVE-2025-32253 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ComMotion Course Booking System course-booking-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Course Booking System: from n/a through <= 6.1.
- Product
- Course Booking System
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Course Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Online Booking & Scheduling Calendar for WordPress by vcita: Generation of Error Message Containing Sensitive InformationCVE-2025-32238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Retrieve Embedded Sensitive Data.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Bookingor: Missing AuthorizationCVE-2025-32231 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bookingor Bookingor bookingor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bookingor: from n/a through <= 2.0.1.
- Product
- Bookingor
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Bookingor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Salon booking system: Missing AuthorizationCVE-2025-32220 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9.
- Product
- Salon booking system
- Affected
- up to 10.31.9
- What to do
- Affects up to 10.31.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Beds24 Online Booking: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32155 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows PHP Local File Inclusion.This issue affects Beds24 Online Booking: from n/a through <= 2.0.28.
- Product
- Beds24 Online Booking
- Affected
- up to 2.0.28
- What to do
- Affects up to 2.0.28. Update Beds24 Online Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Awesome Event Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31416 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Reflected XSS.This issue affects Awesome Event Booking: from n/a through <= 2.8.4.
- Product
- Awesome Event Booking
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update Awesome Event Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Booking Calendar and Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31403 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shiptrack Booking Calendar and Notification booking-calendar-and-notification allows Blind SQL Injection.This issue affects Booking Calendar and Notification: from n/a through <= 4.0.3.
- Product
- Booking Calendar and Notification
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Booking Calendar and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Booking Calendar and Notification: Missing AuthorizationCVE-2025-31381 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in shiptrack Booking Calendar and Notification booking-calendar-and-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar and Notification: from n/a through <= 4.0.3.
- Product
- Booking Calendar and Notification
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Booking Calendar and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025GetBookingsWP: Missing AuthorizationCVE-2025-31896 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in istmoplugins GetBookingsWP get-bookings-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetBookingsWP: from n/a through <= 1.1.27.
- Product
- GetBookingsWP
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update GetBookingsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025TuriTop Booking System: Missing AuthorizationCVE-2025-31541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.
- Product
- TuriTop Booking System
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update TuriTop Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Salon booking system: Incorrect Privilege AssignmentCVE-2025-31560 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Privilege Escalation.This issue affects Salon booking system: from n/a through < 10.15.
- Product
- Salon booking system
- Affected
- up to 10.11
- What to do
- Affects up to 10.11. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Bookmarks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in conlabz GmbH WP Bookmarks wp-bookmarks allows Reflected XSS.This issue affects WP Bookmarks: from n/a through <= 1.1.
- Product
- WP Bookmarks
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Bookmarks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025BookingPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31910 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows SQL Injection.This issue affects BookingPress: from n/a through <= 1.1.28.
- Product
- BookingPress
- Affected
- up to 1.1.28
- What to do
- Affects up to 1.1.28. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Ebook Downloader: Cross-Site Request Forgery (CSRF)CVE-2025-31904 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Cross Site Request Forgery.This issue affects Ebook Downloader: from n/a through <= 1.0.
- Product
- Ebook Downloader
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Ebook Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Ebook Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31894 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Stored XSS.This issue affects Ebook Downloader: from n/a through <= 1.0.
- Product
- Ebook Downloader
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Ebook Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025MyBookProgress by Stormhill Media: Missing AuthorizationCVE-2025-31887 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in zookatron MyBookProgress by Stormhill Media mybookprogress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyBookProgress by Stormhill Media: from n/a through <= 1.0.8.
- Product
- MyBookProgress by Stormhill Media
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update MyBookProgress by Stormhill Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.