Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

2,513 results · page 15 of 51

Nov 6, 2025Download Counter: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-60242 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through <= 1.4.
Product
Download Counter
Affected
up to 1.4
What to do
Affects up to 1.4. Update Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Support Ticket System for WooCommerce (Premium): Unrestricted Upload of File with Dangerous TypeCVE-2025-60235 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Plugify Support Ticket System for WooCommerce (Premium) support-ticket-system-for-woocommerce allows Using Malicious Files.This issue affects Support Ticket System for WooCommerce (Premium): from n/a through <= 2.0.7.
Product
Support Ticket System for WooCommerce (Premium)
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Support Ticket System for WooCommerce (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Custom User Registration Fields for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-60207 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.
Product
Custom User Registration Fields for WooCommerce
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Custom User Registration Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Atarim: Unrestricted Upload of File with Dangerous TypeCVE-2025-60187 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Unrestricted Upload of File with Dangerous Type vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Using Malicious Files.This issue affects Atarim: from n/a through <= 4.2.1.
Product
Atarim
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Lazy Load Optimizer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60074 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Lazy Load Optimizer lazy-load-optimizer allows PHP Local File Inclusion.This issue affects Lazy Load Optimizer: from n/a through <= 1.4.7.
Product
Lazy Load Optimizer
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Lazy Load Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Advanced Settings: Unrestricted Upload of File with Dangerous TypeCVE-2025-58996 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Upload a Web Shell to a Web Server.This issue affects Advanced Settings: from n/a through <= 3.1.1.
Product
Advanced Settings
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Advanced Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Jock On Air Now (JOAN): Missing AuthorizationCVE-2025-58986 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jock On Air Now (JOAN): from n/a through <= 6.0.4.
Product
Jock On Air Now (JOAN)
Affected
up to 6.0.4
What to do
Affects up to 6.0.4. Update Jock On Air Now (JOAN) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Drop Uploader for CF7 - Drag&Drop File Uploader Addon: Unrestricted Upload of File with Dangerous TypeCVE-2025-53283 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon: from n/a through <= 2.4.1.
Product
Drop Uploader for CF7 - Drag&Drop File Uploader Addon
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Drop Uploader for CF7 - Drag&Drop File Uploader Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Blog2Social: Social Media Auto Post & Scheduler: Limited file uploadCVE-2025-12563 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on theuploadVideo() function in all versions up to, and including, 8.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload mp4 files to the 'wp-content/uploads/<YYYY>/<MM>/' directory.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 8.6.0
What to do
Affects up to 8.6.0. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 6, 2025Easy Digital Downloads: Order ManipulationCVE-2025-11271 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verification_override=1. Because this value is attacker-supplied, an unauthenticated actor can submit a forged IPN and have it treated as verified, even on production sites and with verification otherwise enabled. A valid PayPal transaction id is needed, restricting order manipulation to orders placed by the attacker. This, in turn, requires them to have a customer account.
Product
Easy Digital Downloads
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Nov 5, 2025KiotViet Sync: Arbitrary file uploadsCVE-2025-12674 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
KiotViet Sync
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 5, 2025MelAbu WP Download Counter Button: Does not validate the path of files to be downloadedCVE-2025-11072 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
Product
MelAbu WP Download Counter Button
Affected
up to 1.8.6.7
What to do
Affects up to 1.8.6.7. Update MelAbu WP Download Counter Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 4, 2025Easy Upload Files During Checkout: Arbitrary JavaScript file uploadsCVE-2025-12682 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_during_checkout' function in all versions up to, and including, 2.9.8. This makes it possible for unauthenticated attackers to upload arbitrary JavaScript files on the affected site's server which may make remote code execution possible.
Product
Easy Upload Files During Checkout
Affected
up to 2.9.8
What to do
Affects up to 2.9.8. Update Easy Upload Files During Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 4, 2025EM Beer Manager: Arbitrary file upload leading to remote code executionCVE-2025-11724 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. This is due to missing file type validation in the EMBM_Admin_Untappd_Import_image() function and missing authorization checks on the wp_ajax_embm-untappd-import action. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files including PHP files and execute code on the server granted they can provide a mock HTTP server that responds with specific JSON data.
Product
EM Beer Manager
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update EM Beer Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2025Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary CVE-2025-10896 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1.0.2.3. This is due to missing capability checks on the '*_recommended_upgrade_plugin' function which allows arbitrary plugin URLs to be installed. This makes it possible for authenticated attackers with subscriber-level access and above to upload arbitrary plugin packages to the affected site's server via a crafted plugin URL, which may make remote code execution possible.
Affected
up to 1.0.2.3
What to do
Affects up to 1.0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2025RESTful Content Syndication: Arbitrary file uploadsCVE-2025-12171 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function in versions 1.1.0 to 1.5.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This requires the attacker have access to a defined third-party server as specified in the settings, so it is unlikely that this will be exploitable by contributor-level users, and more likely to be exploited by administrators who also have access to the plugin's settings.
Product
RESTful Content Syndication
Affected
1.1.0 to 1.5.0
What to do
Affects 1.1.0 to 1.5.0. Update RESTful Content Syndication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2025WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file uploads when importing recipesCVE-2025-11755 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE).
Product
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2025Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent: Arbitrary file uploadsCVE-2025-11499 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created.
Product
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
Affected
up to 1.1.32
What to do
Affects up to 1.1.32. Update Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2025Flying Images: Optimize and Lazy Load Images for Faster Page Speed: Stored Cross-Site ScriptingCVE-2025-11927 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Flying Images: Optimize and Lazy Load Images for Faster Page Speed
Affected
up to 2.4.14
What to do
Affects up to 2.4.14. Update Flying Images: Optimize and Lazy Load Images for Faster Page Speed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Oct 26, 2025Reloadly: Cross-Site Request Forgery (CSRF)CVE-2025-62956 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in iseremet Reloadly reloadly-topup-widget allows Stored XSS.This issue affects Reloadly: from n/a through <= 2.0.1.
Product
Reloadly
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Reloadly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Activity Plus Reloaded for BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62949 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
Product
Activity Plus Reloaded for BuddyPress
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Activity Plus Reloaded for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2025The Discussion Board – WordPress Forum: Arbitrary shortcode executionCVE-2025-8483 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.5.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
The Discussion Board – WordPress Forum
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update The Discussion Board – WordPress Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2025AIO Forms – Craft Complex Forms Easily: Arbitrary file uploadsCVE-2025-11889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 1.3.18. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
AIO Forms – Craft Complex Forms Easily
Affected
up to 1.3.18
What to do
Affects up to 1.3.18. Update AIO Forms – Craft Complex Forms Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2025Subscribe to Download: Deserialization of Untrusted DataCVE-2025-60224 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Object Injection.This issue affects Subscribe to Download: from n/a through <= 2.0.9.
Product
Subscribe to Download
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Subscribe to Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Simple Job Board: Insertion of Sensitive Information Into Sent DataCVE-2025-59579 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in PressTigers Simple Job Board simple-job-board allows Retrieve Embedded Sensitive Data.This issue affects Simple Job Board: from n/a through <= 2.13.7.
Product
Simple Job Board
Affected
up to 2.13.7
What to do
Affects up to 2.13.7. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Medcity: Unrestricted Upload of File with Dangerous TypeCVE-2025-58963 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Shell to a Web Server.This issue affects Medcity: from n/a through < 1.1.9.
Product
Medcity
What to do
Update Medcity to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Toast Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Toast Mobile Menu toast-responsive-menu allows Stored XSS.This issue affects Toast Mobile Menu: from n/a through <= 1.0.8.
Product
Toast Mobile Menu
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Toast Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Zippy: Unrestricted Upload of File with Dangerous TypeCVE-2025-52758 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.This issue affects Zippy: from n/a through <= 1.7.0.
Product
Zippy
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Zippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Wastia: Unrestricted Upload of File with Dangerous TypeCVE-2025-49060 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through < 1.1.3.
Product
Wastia
What to do
Update Wastia to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Clanora: Unrestricted Upload of File with Dangerous TypeCVE-2025-48106 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through < 1.3.1.
Product
Clanora
What to do
Update Clanora to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WP-Force Images Download: Stored Cross-Site ScriptingCVE-2025-11809 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including, 1.8. This is due to insufficient input sanitization and output escaping on the 'class' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Force Images Download
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP-Force Images Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2025Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: Insecure Direct Object ReferenceCVE-2025-11519 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to offload media that doesn't belong to them.
Product
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 18, 2025PPOM – Product Addons & Custom Fields for WooCommerce: Arbitrary file uploadsCVE-2025-11391 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated.
Product
PPOM – Product Addons & Custom Fields for WooCommerce
Affected
up to 33.0.15
What to do
Affects up to 33.0.15. Update PPOM – Product Addons & Custom Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025DocoDoco Store Locator: Arbitrary file uploadsCVE-2025-10754 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The DocoDoco Store Locator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
DocoDoco Store Locator
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update DocoDoco Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025WP Dashboard Chat: SQL InjectionCVE-2025-10660 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Dashboard Chat
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WP Dashboard Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025Demo Import Kit: Arbitrary file uploadsCVE-2025-10051 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Demo Import Kit
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Demo Import Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 15, 2025Flex QR Code Generator: Arbitrary file uploadsCVE-2025-10041 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Flex QR Code Generator
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2025Ovatheme Events Manager: Arbitrary file uploadsCVE-2025-6553 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Ovatheme Events Manager
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Ovatheme Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net themeforest.net
Oct 11, 2025Contest Gallery – Upload, Vote & Sell with PayPal and Stripe: CSV InjectionCVE-2025-11254 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Product
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe
Affected
up to 27.0.3
What to do
Affects up to 27.0.3. Update Contest Gallery – Upload, Vote & Sell with PayPal and Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 7, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Does not validate the path of files to be downloadedCVE-2025-10162 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.
Product
Admin and Customer Messages After Order for WooCommerce: OrderConvo
Affected
up to 15.1
What to do
Affects up to 15.1. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2025Contest Gallery – Upload, Vote & Sell with PayPal and Stripe: Stored Cross-Site ScriptingCVE-2025-10383 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field parameters in all versions up to, and including, 27.0.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with author-level access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe
Affected
up to 27.0.2
What to do
Affects up to 27.0.2. Update Contest Gallery – Upload, Vote & Sell with PayPal and Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025OAuth Single Sign On – SSO (OAuth Client): Improper Verification of Cryptographic SignatureCVE-2025-9485 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.26.12
What to do
Affects up to 6.26.12. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025AP Background: Arbitrary file uploadsCVE-2025-9561 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and insufficient file validation within the advParallaxBackAdminSaveSlider() handler in versions 3.8.1 to 3.8.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
AP Background
Affected
3.8.1 to 3.8.2
What to do
Affects 3.8.1 to 3.8.2. Update AP Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 3, 2025WP Dispatcher: Arbitrary file uploadsCVE-2025-9212 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The directory does have an .htaccess file which limits the ability to achieve remote code execution.
Product
WP Dispatcher
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WP Dispatcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025Backup Bolt: Arbitrary file downloads and backup location writesCVE-2025-10306 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process_backup_batch() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download directories outside of the webroot and write backup zip files to arbitrary locations.
Product
Backup Bolt
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Backup Bolt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 2, 2025Yoast SEO Premium: Stored Cross-Site ScriptingCVE-2025-11241 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload.
Product
Yoast SEO Premium
Affected
25.7 to 25.9
What to do
Affects 25.7 to 25.9. Update Yoast SEO Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.yoast.com sec.stealthcopter.com
Sep 30, 2025Post By Email: Arbitrary file uploadsCVE-2025-9762 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all versions up to, and including, 1.0.4b. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Post By Email
Affected
up to 1.0.4b
What to do
Affects up to 1.0.4b. Update Post By Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025Qyrr – simply and modern QR-Code creation: Arbitrary file uploadsCVE-2025-10000 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Qyrr – simply and modern QR-Code creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the blob_to_file() function in all versions up to, and including, 2.0.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Qyrr – simply and modern QR-Code creation
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Qyrr – simply and modern QR-Code creation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025WooCommerce Designer Pro: Unrestricted Upload of File with Dangerous TypeCVE-2025-60219 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.This issue affects WooCommerce Designer Pro: from n/a through <= 1.9.24.
Product
WooCommerce Designer Pro
Affected
up to 1.9.24
What to do
Affects up to 1.9.24. Update WooCommerce Designer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Job Board Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60162 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows DOM-Based XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.
Product
Job Board Manager
Affected
up to 2.1.61
What to do
Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.