Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,491 results · page 14 of 30

May 26, 2025Spotlight - Social Media Feeds (Premium): Insertion of Sensitive Information Into Sent DataCVE-2025-39498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds (Premium) allows Retrieve Embedded Sensitive Data.This issue affects Spotlight - Social Media Feeds (Premium): from n/a through 1.7.1.
Product
Spotlight - Social Media Feeds (Premium)
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Spotlight - Social Media Feeds (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Jarvis – Night Club, Concert, Festival: Deserialization of Untrusted DataCVE-2025-32292 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Jarvis – Night Club, Concert, Festival WordPress jarvis allows Object Injection.This issue affects Jarvis – Night Club, Concert, Festival WordPress: from n/a through <= 1.8.11.
Product
Jarvis – Night Club, Concert, Festival
Affected
up to 1.8.11
What to do
Affects up to 1.8.11. Update Jarvis – Night Club, Concert, Festival to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Grand Conference: Deserialization of Untrusted DataCVE-2025-39354 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: from n/a through <= 5.3.
Product
Grand Conference
Affected
up to 5.3
What to do
Affects up to 5.3. Update Grand Conference to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Author Box Plugin With Different Description: Cross-Site Request Forgery (CSRF)CVE-2025-39371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Author Box Plugin With Different Description author-box-with-different-description allows Cross Site Request Forgery.This issue affects Author Box Plugin With Different Description: from n/a through <= 1.3.5.
Product
Author Box Plugin With Different Description
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Author Box Plugin With Different Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025iCafe Library: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39370 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cnilsson iCafe Library icafe-library allows SQL Injection.This issue affects iCafe Library: from n/a through <= 1.8.3.
Product
iCafe Library
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update iCafe Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 17, 2025Echo RSS Feed Post Generator: Arbitrary file uploadsCVE-2025-4391 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the echo_generate_featured_image() function in all versions up to, and including, 5.4.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Echo RSS Feed Post Generator
Affected
up to 5.4.8.1
What to do
Affects up to 5.4.8.1. Update Echo RSS Feed Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
May 16, 2025Featured Posts Scroll: Cross-Site Request Forgery (CSRF)CVE-2025-32245 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll featured-posts-scroll allows Stored XSS.This issue affects Featured Posts Scroll: from n/a through <= 1.25.
Product
Featured Posts Scroll
Affected
up to 1.25
What to do
Affects up to 1.25. Update Featured Posts Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025webtoffee-gdpr-cookie-consent: Does not properly sanitize and escape the IP headersCVE-2024-8397 · WordPress plugins & themes · reported by WPScanMedium 5.4
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context.
Product
webtoffee-gdpr-cookie-consent
Fixed in
2.6.1
What to do
Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025webtoffee-gdpr-cookie-consent: Does not have CSRF checks in some bulk actionsCVE-2024-8286 · WordPress plugins & themes · reported by WPScanMedium 6.5
The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks
Product
webtoffee-gdpr-cookie-consent
Fixed in
2.6.1
What to do
Update webtoffee-gdpr-cookie-consent to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025wccp-pro: Contains an open-redirect flaw via the referrer parameterCVE-2024-6690 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites
Product
wccp-pro
Fixed in
15.3
What to do
Update wccp-pro to 15.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employeesCVE-2024-12812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Fixed in
1.13.4
What to do
Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Nokaut Offers Box: Does not have CSRF check in placeCVE-2024-10634 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset the Nokaut Offers Box WordPress plugin through 1.4.0 via a CSRF attack
Product
Nokaut Offers Box
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Nokaut Offers Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Nokaut Offers Box: Does not sanitize and escape some of its settingsCVE-2024-10632 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Nokaut Offers Box
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Nokaut Offers Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025Social Slider Feed: Does not sanitise and escape some of its settingsCVE-2024-10149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Social Slider Feed
Fixed in
2.2.9
What to do
Update Social Slider Feed to 2.2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Jetpack WordPress plugin before 13.8, Jetpack Boost: Use regexes in the Site Accelerator featuresCVE-2024-10076 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks
Product
Jetpack WordPress plugin before 13.8, Jetpack Boost
Fixed in
13.8
What to do
Update Jetpack WordPress plugin before 13.8, Jetpack Boost to 13.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025aBitGone CommentSafe: Does not have CSRF check in some placesCVE-2023-7174 · WordPress plugins & themes · reported by WPScanHigh 7.1
The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
aBitGone CommentSafe
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update aBitGone CommentSafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2025LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2025-3769 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.1.92
What to do
Affects up to 5.1.92. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2025PeepSo Core: File Uploads: Insecure Direct Object ReferenceCVE-2024-8988 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PeepSo Core: File Uploads plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.6.0 via the file_download REST API endpoint due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to download files uploaded by others users and expose potentially sensitive information.
Product
PeepSo Core: File Uploads
Affected
up to 6.4.6.0
What to do
Affects up to 6.4.6.0. Update PeepSo Core: File Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record peepso.com wordfence.com
May 7, 2025ELEX Product Feed for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47643 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2.
Product
ELEX Product Feed for WooCommerce
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update ELEX Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Bulk Featured Image: Missing AuthorizationCVE-2025-47591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Featured Image: from n/a through <= 1.2.4.
Product
Bulk Featured Image
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Bulk Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 6, 2025WPshop 2 – E-Commerce: Insecure Direct Object ReferenceCVE-2025-3853 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.
Product
WPshop 2 – E-Commerce
Affected
2.0.0 to 2.6.0
What to do
Affects 2.0.0 to 2.6.0. Update WPshop 2 – E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2025Download Manager and Payment Form WordPress Plugin – WP SmartPay: Insecure Direct Object ReferenceCVE-2025-3851 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's data like email address, name, and notes.
Product
Download Manager and Payment Form WordPress Plugin – WP SmartPay
Affected
1.1.0 to 2.7.13
What to do
Affects 1.1.0 to 2.7.13. Update Download Manager and Payment Form WordPress Plugin – WP SmartPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3281 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the create_stripe_subscription() function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that have registered through the plugin.
Product
User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2025Homey: Insecure Direct Object ReferenceCVE-2025-1327 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's accounts.
Product
Homey
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3889 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.
Product
WordPress Simple Shopping Cart
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3874 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes.
Product
WordPress Simple Shopping Cart
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org plugins.trac.wordpress.org
Apr 28, 2025Admin and Site Enhancements (ASE): Uses a hardcoded password in its Password Protection featureCVE-2024-13688 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass the protection offered via a crafted request
Product
Admin and Site Enhancements (ASE)
Fixed in
7.6.10
What to do
Update Admin and Site Enhancements (ASE) to 7.6.10 or newer.
Full record and what to do →NVD record wpscan.com
Apr 24, 2025Unsafe Mimetypes: Cross-Site Request Forgery (CSRF)CVE-2025-46507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ldrumm Unsafe Mimetypes unsafe-mimetypes allows Stored XSS.This issue affects Unsafe Mimetypes: from n/a through <= 0.1.4.
Product
Unsafe Mimetypes
Affected
up to 0.1.4
What to do
Affects up to 0.1.4. Update Unsafe Mimetypes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Mini twitter feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46496 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oniswap Mini twitter feed mini-twitter-feed allows Stored XSS.This issue affects Mini twitter feed: from n/a through <= 3.0.
Product
Mini twitter feed
Affected
up to 3.0
What to do
Affects up to 3.0. Update Mini twitter feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Image Hover Effects For WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46484 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Image Hover Effects For WPBakery Page Builder image-hover-effects-for-visual-composer allows DOM-Based XSS.This issue affects Image Hover Effects For WPBakery Page Builder: from n/a through <= 2.0.
Product
Image Hover Effects For WPBakery Page Builder
Affected
up to 2.0
What to do
Affects up to 2.0. Update Image Hover Effects For WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print): Insecure Direct Object ReferenceCVE-2025-1284 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xc_woo_printer_preview AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's invoices and orders which can contain sensitive information.
Product
Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print)
Affected
up to 4.1
What to do
Affects up to 4.1. Update Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Apr 17, 2025WPCafe: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39452 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through <= 2.2.32.
Product
WPCafe
Affected
up to 2.2.32
What to do
Affects up to 2.2.32. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025WP Featured Screenshot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rico Macchi WP Featured Screenshot wp-featured-screenshot allows Reflected XSS.This issue affects WP Featured Screenshot: from n/a through <= 1.3.
Product
WP Featured Screenshot
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Featured Screenshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025WooCommerce Products without featured images: Cross-Site Request Forgery (CSRF)CVE-2025-32545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in SOFTAGON WooCommerce Products without featured images woocommerce-products-without-featured-images allows Reflected XSS.This issue affects WooCommerce Products without featured images: from n/a through <= 0.1.
Product
WooCommerce Products without featured images
Affected
up to 0.1
What to do
Affects up to 0.1. Update WooCommerce Products without featured images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Feedify – Web Push Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32540 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in feedify Feedify – Web Push Notifications push-notification-by-feedify allows Reflected XSS.This issue affects Feedify – Web Push Notifications: from n/a through <= 2.4.5.
Product
Feedify – Web Push Notifications
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025iCal Feeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32528 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maximevalette iCal Feeds ical-feeds allows Reflected XSS.This issue affects iCal Feeds: from n/a through <= 1.5.3.
Product
iCal Feeds
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update iCal Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025ZooEffect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26954 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 1pluginjquery ZooEffect 1-jquery-photo-gallery-slideshow-flash allows Reflected XSS.This issue affects ZooEffect: from n/a through <= 1.11.
Product
ZooEffect
Affected
up to 1.11
What to do
Affects up to 1.11. Update ZooEffect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Widget for Social Page Feeds: Does not sanitise and escape some of its settingsCVE-2024-13207 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Widget for Social Page Feeds
Fixed in
6.4.2
What to do
Update Widget for Social Page Feeds to 6.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Apr 12, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3292 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to update other user's passwords, if they have access to the user ID and email.
Product
User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 12, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3282 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type.
Product
User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13338 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfy_cache_delete functionality . This makes it possible for unauthenticated attackers to clear the cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the 'setup-wbcr_clearfy' page. This makes it possible for unauthenticated attackers to update the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.dev plugins.trac.wordpress.org
Apr 10, 2025Feedify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13874 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Feedify
Fixed in
2.4.6
What to do
Update Feedify to 2.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 9, 2025Woo Product Feed For Marketing Channels: Missing AuthorizationCVE-2025-31377 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels woocommerce-to-google-merchant-center allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Product Feed For Marketing Channels: from n/a through <= 1.9.0.
Product
Woo Product Feed For Marketing Channels
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Woo Product Feed For Marketing Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP Editor.md – The Perfect WordPress Markdown Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31035 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markdown Editor wp-editormd allows Stored XSS.This issue affects WP Editor.md – The Perfect WordPress Markdown Editor: from n/a through <= 10.2.1.
Product
WP Editor.md – The Perfect WordPress Markdown Editor
Affected
up to 10.2.1
What to do
Affects up to 10.2.1. Update WP Editor.md – The Perfect WordPress Markdown Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Stored Cross-Site ScriptingCVE-2025-3100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Affected
up to 2.6.22
What to do
Affects up to 2.6.22. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 4, 2025Jetpack Feedback Exporter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32251 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in J. Tyler Wiest Jetpack Feedback Exporter jetpack-feedback-exporter allows Retrieve Embedded Sensitive Data.This issue affects Jetpack Feedback Exporter: from n/a through <= 1.23.
Product
Jetpack Feedback Exporter
Affected
up to 1.23
What to do
Affects up to 1.23. Update Jetpack Feedback Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Easy Google Maps: Improper Restriction of XML External Entity ReferenceCVE-2025-32138 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Restriction of XML External Entity Reference vulnerability in supsystic Easy Google Maps google-maps-easy allows XML Injection.This issue affects Easy Google Maps: from n/a through <= 1.11.18.
Product
Easy Google Maps
Affected
up to 1.11.18
What to do
Affects up to 1.11.18. Update Easy Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturCVE-2025-2780 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturedImage' function in all versions up to, and including, 5.4.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
up to 5.4.21
What to do
Affects up to 5.4.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hub.woffice.io wordfence.com
Apr 1, 2025Arrow Custom Feed for Twitter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31897 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Custom Feed for Twitter arrow-twitter-feed allows Stored XSS.This issue affects Arrow Custom Feed for Twitter: from n/a through <= 1.5.3.
Product
Arrow Custom Feed for Twitter
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Arrow Custom Feed for Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.