Vulnerability database

15,933 results · page 167 of 319

• Jan 16, 2025CNZZ&51LA for: Cross-Site Request Forgery (CSRF)CVE-2025-23823 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in jprintf CNZZ&51LA for WordPress cnzz51la-for-wordpress allows Cross Site Request Forgery.This issue affects CNZZ&51LA for WordPress: from n/a through <= 1.0.1.

  Product

  CNZZ&51LA for

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update CNZZ&51LA for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Category Custom Fields: Cross-Site Request Forgery (CSRF)CVE-2025-23822 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in alicornea Category Custom Fields categorycustomfields allows Cross Site Request Forgery.This issue affects Category Custom Fields: from n/a through <= 1.0.

  Product

  Category Custom Fields

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Category Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Cookies Alert: Cross-Site Request Forgery (CSRF)CVE-2025-23821 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in aleapp WP Cookies Alert wp-cookies-alert allows Cross Site Request Forgery.This issue affects WP Cookies Alert: from n/a through <= 1.1.1.

  Product

  WP Cookies Alert

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update WP Cookies Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Content Security Policy Pro: Cross-Site Request Forgery (CSRF)CVE-2025-23820 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in thapa.laxman Content Security Policy Pro content-security-policy-pro allows Cross Site Request Forgery.This issue affects Content Security Policy Pro: from n/a through <= 1.3.5.

  Product

  Content Security Policy Pro

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Content Security Policy Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025More Link Modifier: Cross-Site Request Forgery (CSRF)CVE-2025-23818 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in pyko More Link Modifier more-link-modifier allows Stored XSS.This issue affects More Link Modifier: from n/a through <= 1.0.3.

  Product

  More Link Modifier

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update More Link Modifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025MHR-Custom-Anti-Copy: Cross-Site Request Forgery (CSRF)CVE-2025-23817 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mahadirz MHR-Custom-Anti-Copy mhr-custom-anti-copy allows Stored XSS.This issue affects MHR-Custom-Anti-Copy: from n/a through <= 2.0.

  Product

  MHR-Custom-Anti-Copy

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update MHR-Custom-Anti-Copy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Metaphor Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23816 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Metaphor Widgets allows Stored XSS. This issue affects Metaphor Widgets: from n/a through 2.4.

  Product

  Metaphor Widgets

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Metaphor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025root Cookie: Cross-Site Request Forgery (CSRF)CVE-2025-23815 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in linickx root Cookie allows Cross Site Request Forgery. This issue affects root Cookie: from n/a through 1.6.

  Product

  root Cookie

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update root Cookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Len Slider: Cross-Site Request Forgery (CSRF)CVE-2025-23810 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Igor Sazonov Len Slider len-slider allows Reflected XSS.This issue affects Len Slider: from n/a through <= 2.0.11.

  Product

  Len Slider

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update Len Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Custom List Table Example: Cross-Site Request Forgery (CSRF)CVE-2025-23808 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Dutch van Andel Custom List Table Example custom-list-table-example allows Reflected XSS.This issue affects Custom List Table Example: from n/a through <= 1.4.1.

  Product

  Custom List Table Example

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Custom List Table Example to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Spiderpowa Embed PDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23807 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jim2212001 Spiderpowa Embed PDF spiderpowa-embed-pdf allows Stored XSS.This issue affects Spiderpowa Embed PDF: from n/a through <= 1.0.

  Product

  Spiderpowa Embed PDF

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Spiderpowa Embed PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025SEOReseller Partner: Cross-Site Request Forgery (CSRF)CVE-2025-23805 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in itamarg SEOReseller Partner sr-partner allows Cross Site Request Forgery.This issue affects SEOReseller Partner: from n/a through <= 1.3.15.

  Product

  SEOReseller Partner

  Affected

  up to 1.3.15

  What to do

  Affects up to 1.3.15. Update SEOReseller Partner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Service Payment Form With Authorize.net: Cross-Site Request Forgery (CSRF)CVE-2025-23804 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shiv Prakash Tiwari WP Service Payment Form With Authorize.net wp-service-payment-form-with-authorizenet allows Reflected XSS.This issue affects WP Service Payment Form With Authorize.net: from n/a through <= 2.6.0.

  Product

  WP Service Payment Form With Authorize.net

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update WP Service Payment Form With Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP-Revive Adserver: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23802 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SteveSoehl WP-Revive Adserver wp-revive-adserver allows Stored XSS.This issue affects WP-Revive Adserver: from n/a through <= 2.2.1.

  Product

  WP-Revive Adserver

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update WP-Revive Adserver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Style Admin: Cross-Site Request Forgery (CSRF)CVE-2025-23801 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in FuzzGuard Style Admin style-admin allows Stored XSS.This issue affects Style Admin: from n/a through <= 1.4.3.

  Product

  Style Admin

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Style Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025OrangeBox: Cross-Site Request Forgery (CSRF)CVE-2025-23800 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in nova706 OrangeBox orangebox allows Cross Site Request Forgery.This issue affects OrangeBox: from n/a through <= 3.0.0.

  Product

  OrangeBox

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update OrangeBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Options Editor: Cross-Site Request Forgery (CSRF)CVE-2025-23797 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Cross-Site Request Forgery (CSRF) vulnerability in Mike Selander WP Options Editor wp-options-editor allows Privilege Escalation.This issue affects WP Options Editor: from n/a through <= 1.1.

  Product

  WP Options Editor

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP Options Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Easy Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23796 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tushar Patel Easy Portfolio easy-portfolio allows Stored XSS.This issue affects Easy Portfolio: from n/a through <= 1.3.

  Product

  Easy Portfolio

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Easy Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Easy FAQs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23795 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ghuger Easy FAQs easy-faqs allows Stored XSS.This issue affects Easy FAQs: from n/a through <= 3.2.1.

  Product

  Easy FAQs

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update Easy FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025wp_amaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23794 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _rccoder_ wp_amaps wp-amaps allows Stored XSS.This issue affects wp_amaps: from n/a through <= 1.7.

  Product

  wp_amaps

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update wp_amaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Auto FTP: Cross-Site Request Forgery (CSRF)CVE-2025-23793 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Turcu Auto FTP auto-ftp allows Stored XSS.This issue affects Auto FTP: from n/a through <= 1.0.1.

  Product

  Auto FTP

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Auto FTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Horizontal Line Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23791 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mikakaltoft Horizontal Line Shortcode horizontal-line-shortcode allows Stored XSS.This issue affects Horizontal Line Shortcode: from n/a through <= 1.0.

  Product

  Horizontal Line Shortcode

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Horizontal Line Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025GDPR Personal Data Reports: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23777 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in willowsconsulting GDPR Personal Data Reports gdpr-personal-data-reports allows Stored XSS.This issue affects GDPR Personal Data Reports: from n/a through <= 1.0.5.

  Product

  GDPR Personal Data Reports

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update GDPR Personal Data Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025GMAPS for WPBakery Page Builder Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23775 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WWP GMAPS for WPBakery Page Builder Free gmaps-for-visual-composer-free allows Stored XSS.This issue affects GMAPS for WPBakery Page Builder Free: from n/a through <= 1.2.

  Product

  GMAPS for WPBakery Page Builder Free

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update GMAPS for WPBakery Page Builder Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025imaGenius: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23772 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eugenio Petulla’ imaGenius imagenius allows Stored XSS.This issue affects imaGenius: from n/a through <= 1.7.

  Product

  imaGenius

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update imaGenius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025W3SPEEDSTER: Cross-Site Request Forgery (CSRF)CVE-2025-23765 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in w3speedster W3SPEEDSTER w3speedster-wp allows Cross Site Request Forgery.This issue affects W3SPEEDSTER: from n/a through <= 7.33.

  Product

  W3SPEEDSTER

  Affected

  up to 7.33

  What to do

  Affects up to 7.33. Update W3SPEEDSTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Chatter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23760 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Volkov Chatter allows Stored XSS. This issue affects Chatter: from n/a through 1.0.1.

  Product

  Chatter

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Chatter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Greek Namedays Widget From Eortologio.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23783 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in carrotbits Greek Namedays Widget From Eortologio.Net greek-namedays-widget allows Stored XSS.This issue affects Greek Namedays Widget From Eortologio.Net: from n/a through <= 20191113.

  Product

  Greek Namedays Widget From Eortologio.Net

  Affected

  up to 20191113

  What to do

  Affects up to 20191113. Update Greek Namedays Widget From Eortologio.Net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Marmoset Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23767 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revoxis Marmoset Viewer marmoset-viewer allows Stored XSS.This issue affects Marmoset Viewer: from n/a through <= 1.9.3.

  Product

  Marmoset Viewer

  Affected

  up to 1.9.3

  What to do

  Affects up to 1.9.3. Update Marmoset Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025mybb Last Topics: Cross-Site Request Forgery (CSRF)CVE-2025-23749 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in progpars.net mybb Last Topics mybb-last-topics allows Stored XSS.This issue affects mybb Last Topics: from n/a through <= 1.0.

  Product

  mybb Last Topics

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update mybb Last Topics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Call me Now: Cross-Site Request Forgery (CSRF)CVE-2025-23745 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Tussendoor B.V. Call me Now call-me-now allows Stored XSS.This issue affects Call me Now: from n/a through <= 1.0.5.

  Product

  Call me Now

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Call me Now to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Social Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-23743 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in MartijnScheijbeler Social Analytics social-analytics allows Stored XSS.This issue affects Social Analytics: from n/a through <= 0.2.

  Product

  Social Analytics

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Social Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Web Push: Cross-Site Request Forgery (CSRF)CVE-2025-23720 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Marco Castelluccio Web Push web-push allows Stored XSS.This issue affects Web Push: from n/a through <= 1.4.0.

  Product

  Web Push

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Web Push to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Theme My Ontraport Smartform: Cross-Site Request Forgery (CSRF)CVE-2025-23717 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in itmooti Theme My Ontraport Smartform theme-my-ontraport-smartform allows Stored XSS.This issue affects Theme My Ontraport Smartform: from n/a through <= 1.2.11.

  Product

  Theme My Ontraport Smartform

  Affected

  up to 1.2.11

  What to do

  Affects up to 1.2.11. Update Theme My Ontraport Smartform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Post & Page Notes: Cross-Site Request Forgery (CSRF)CVE-2025-23715 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in RaymondDesign Post & Page Notes post-page-notes allows Stored XSS.This issue affects Post & Page Notes: from n/a through <= 0.1.1.

  Product

  Post & Page Notes

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Post & Page Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Hack me if you can: Cross-Site Request Forgery (CSRF)CVE-2025-23713 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in artanik Hack me if you can hack-me-if-you-can allows Stored XSS.This issue affects Hack me if you can: from n/a through <= 1.2.

  Product

  Hack me if you can

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Hack me if you can to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Kapost: Cross-Site Request Forgery (CSRF)CVE-2025-23712 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in kapostintegrations Kapost kapost-byline allows Stored XSS.This issue affects Kapost: from n/a through <= 2.2.9.

  Product

  Kapost

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update Kapost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Flying Twitter Birds: Cross-Site Request Forgery (CSRF)CVE-2025-23710 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mayur Sojitra Flying Twitter Birds flying-twitter-birds allows Stored XSS.This issue affects Flying Twitter Birds: from n/a through <= 1.8.

  Product

  Flying Twitter Birds

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Flying Twitter Birds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025DF Draggable: Cross-Site Request Forgery (CSRF)CVE-2025-23708 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Dominic Fallows DF Draggable df-draggable allows Stored XSS.This issue affects DF Draggable: from n/a through <= 1.13.2.

  Product

  DF Draggable

  Affected

  up to 1.13.2

  What to do

  Affects up to 1.13.2. Update DF Draggable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Free MailClient FMC: Cross-Site Request Forgery (CSRF)CVE-2025-23703 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in cstoltenkamp Free MailClient FMC mailclient allows Stored XSS.This issue affects Free MailClient FMC: from n/a through <= 1.0.

  Product

  Free MailClient FMC

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Free MailClient FMC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Anonymize Links: Cross-Site Request Forgery (CSRF)CVE-2025-23702 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Schalk Burger Anonymize Links anonymize-links allows Stored XSS.This issue affects Anonymize Links: from n/a through <= 1.1.

  Product

  Anonymize Links

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Anonymize Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Event Countdown Timer Plugin by TechMix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23699 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Event Countdown Timer Plugin by TechMix event-countdown-timer allows Reflected XSS.This issue affects Event Countdown Timer Plugin by TechMix: from n/a through <= 1.4.

  Product

  Event Countdown Timer Plugin by TechMix

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Event Countdown Timer Plugin by TechMix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Custom Google Search: Cross-Site Request Forgery (CSRF)CVE-2025-23698 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivanra10 WP Custom Google Search wp-custom-google-search allows Stored XSS.This issue affects WP Custom Google Search: from n/a through <= 1.0.

  Product

  WP Custom Google Search

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Custom Google Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Shabbos and Yom Tov: Cross-Site Request Forgery (CSRF)CVE-2025-23694 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in shabboscommerce Shabbos and Yom Tov shabbos-and-yom-tov allows Stored XSS.This issue affects Shabbos and Yom Tov: from n/a through <= 1.9.

  Product

  Shabbos and Yom Tov

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update Shabbos and Yom Tov to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Secure CAPTCHA: Cross-Site Request Forgery (CSRF)CVE-2025-23693 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in uosiu Secure CAPTCHA secure-captcha allows Stored XSS.This issue affects Secure CAPTCHA: from n/a through <= 1.2.

  Product

  Secure CAPTCHA

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Secure CAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Slider for Writers: Cross-Site Request Forgery (CSRF)CVE-2025-23692 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in artanik Slider for Writers slider-for-writers allows Stored XSS.This issue affects Slider for Writers: from n/a through <= 1.3.

  Product

  Slider for Writers

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Slider for Writers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Send to Twitter: Cross-Site Request Forgery (CSRF)CVE-2025-23691 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Braulio Aquino Send to Twitter send-to-twitter allows Stored XSS.This issue affects Send to Twitter: from n/a through <= 1.7.2.

  Product

  Send to Twitter

  Affected

  up to 1.7.2

  What to do

  Affects up to 1.7.2. Update Send to Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Book a Place: Cross-Site Request Forgery (CSRF)CVE-2025-23690 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ArtkanMedia Book a Place book-a-place allows Stored XSS.This issue affects Book a Place: from n/a through <= 0.7.1.

  Product

  Book a Place

  Affected

  up to 0.7.1

  What to do

  Affects up to 0.7.1. Update Book a Place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Blogger Image Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23689 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a.

  Product

  Blogger Image Import

  What to do

  Update Blogger Image Import to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025HTTP to HTTPS link changer by Eyga.net: Cross-Site Request Forgery (CSRF)CVE-2025-23677 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in DSmidge HTTP to HTTPS link changer by Eyga.net https-links-in-content allows Stored XSS.This issue affects HTTP to HTTPS link changer by Eyga.net: from n/a through <= 0.2.4.

  Product

  HTTP to HTTPS link changer by Eyga.net

  Affected

  up to 0.2.4

  What to do

  Affects up to 0.2.4. Update HTTP to HTTPS link changer by Eyga.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.