Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

2,149 results · page 17 of 43

Nov 6, 2025Custom User Registration Fields for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-60207 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.
Product
Custom User Registration Fields for WooCommerce
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Custom User Registration Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Premmerce User Roles: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60193 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows PHP Local File Inclusion.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.
Product
Premmerce User Roles
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Premmerce User Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Miraculous Core: Authorization Bypass Through User-Controlled KeyCVE-2025-58627 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.
Product
Miraculous Core
What to do
Update Miraculous Core to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025User Registration Aide: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53239 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bnovotny User Registration Aide user-registration-aide allows Reflected XSS.This issue affects User Registration Aide: from n/a through <= 1.5.3.8.
Product
User Registration Aide
Affected
up to 1.5.3.8
What to do
Affects up to 1.5.3.8. Update User Registration Aide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025wpNamedUsers: Cross-Site Request Forgery (CSRF)CVE-2025-48083 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in andriassundskard wpNamedUsers wpnamedusers allows Stored XSS.This issue affects wpNamedUsers: from n/a through <= 0.5.
Product
wpNamedUsers
Affected
up to 0.5
What to do
Affects up to 0.5. Update wpNamedUsers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 5, 2025Ace User Management: Does not properly validate that a password reset token is associated with the user who requested itCVE-2025-6027 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.
Product
Ace User Management
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Ace User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 5, 2025ElementInvader Addons for Elementor: Allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form actionCVE-2025-10873 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.
Product
ElementInvader Addons for Elementor
Fixed in
1.4.1
What to do
Update ElementInvader Addons for Elementor to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2025FunnelKit: Does not sanitize user input before echoing it back in some of its checkout-related AJAX actionsCVE-2025-10567 · WordPress plugins & themes · reported by WPScanMedium 6.3
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.
Product
FunnelKit
Fixed in
3.12.0.1
What to do
Update FunnelKit to 3.12.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 4, 2025Simple User Capabilities: Privilege EscalationCVE-2025-12158 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.
Product
Simple User Capabilities
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple User Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Nov 4, 2025Simple User Capabilities: Unauthorized modification of dataCVE-2025-12157 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_reset_capability' AJAX endpoint in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to reset any user's capabilities.
Product
Simple User Capabilities
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple User Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Oct 31, 2025WordPress User Extra Fields: Arbitrary file deletionCVE-2025-7846 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WordPress User Extra Fields
Affected
up to 16.7
What to do
Affects up to 16.7. Update WordPress User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 30, 2025FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.): Unauthorized modification of dataCVE-2025-11975 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_changes() function in all versions up to, and including, 1.1.23.0. This makes it possible for unauthenticated attackers to add and edit sync rules.
Product
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)
Affected
up to 1.1.23.0
What to do
Affects up to 1.1.23.0. Update FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 29, 2025Premmerce User Roles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64291 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Stored XSS.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.
Product
Premmerce User Roles
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Premmerce User Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025RTMKit: Authorization Bypass Through User-Controlled KeyCVE-2025-64283 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RTMKit: from n/a through <= 1.6.7.
Product
RTMKit
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Doppler Forms: Registers an AJAX action install_extension without verifying user capabilities or using a nonceCVE-2025-9544 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).
Product
Doppler Forms
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 26, 2025Dynamic User Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62982 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dynamic User Directory: from n/a through <= 2.3.
Product
Dynamic User Directory
Affected
up to 2.3
What to do
Affects up to 2.3. Update Dynamic User Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025USERCENTRICS CMP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62920 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webnique USERCENTRICS CMP usercentrics-consent-management-platform allows Stored XSS.This issue affects USERCENTRICS CMP: from n/a through <= 1.0.9.
Product
USERCENTRICS CMP
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update USERCENTRICS CMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Premmerce User Roles: Missing AuthorizationCVE-2025-62883 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.
Product
Premmerce User Roles
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Premmerce User Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2025FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.): Cross-Site Request ForgeryCVE-2025-11976 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23.0. This is due to missing or incorrect nonce validation on the save_changes function. This makes it possible for unauthenticated attackers to add or edit sync rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)
Affected
up to 1.1.23.0
What to do
Affects up to 1.1.23.0. Update FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2025User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds: Unauthorized access of dataCVE-2025-10694 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `maybe_load_onboarding_wizard` function in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to access the onboarding wizard page and view configuration information including the administrator email address.
Product
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2025Front End Users: Missing AuthorizationCVE-2025-62072 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33.
Product
Front End Users
Affected
up to 3.2.33
What to do
Affects up to 3.2.33. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Simple User Registration: Incorrect Privilege AssignmentCVE-2025-53428 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Registration: from n/a through <= 6.8.
Product
Simple User Registration
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Houzez: Authorization Bypass Through User-Controlled KeyCVE-2025-49952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.
Product
Houzez
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2025RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: PHP Object InjectionCVE-2017-20208 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 3.7.9.3
What to do
Affects up to 3.7.9.3. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2025Truelysell Core: Arbitrary User Password ChangeCVE-2025-10742 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode.
Product
Truelysell Core
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Truelysell Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 8, 2025RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: SQL InjectionCVE-2025-11204 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 6.0.6.2
What to do
Affects up to 6.0.6.2. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Restrict User Registration: Cross-Site Request ForgeryCVE-2025-9892 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the update() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Restrict User Registration
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Restrict User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 2, 2025Ajax WooSearch: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9697 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Ajax WooSearch
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ajax WooSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 2, 2025CTL Behance Importer Lite: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9587 · WordPress plugins & themes · reported by WPScanHigh 8.6
The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
CTL Behance Importer Lite
Affected
up to 1.0
What to do
Affects up to 1.0. Update CTL Behance Importer Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 26, 2025User Notes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60136 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj User Notes user-notes allows Stored XSS.This issue affects User Notes: from n/a through <= 1.0.2.
Product
User Notes
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update User Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025WPFront User Role Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60102 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront User Role Editor wpfront-user-role-editor allows Stored XSS.This issue affects WPFront User Role Editor: from n/a through <= 4.2.3.
Product
WPFront User Role Editor
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update WPFront User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Banhammer – Monitor Site Traffic, Block Bad Users and Bots: Blocking BypassCVE-2025-10745 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5() and base64_encode() and then stored in the `banhammer_secret_key` option. This makes it possible for unauthenticated attackers to bypass the plugin’s logging and blocking by appending a GET parameter named `banhammer-process_{SECRET}` where `{SECRET}` is the predictable value, thereby causing Banhammer to abort its protections for that request.
Product
Banhammer – Monitor Site Traffic, Block Bad Users and Bots
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update Banhammer – Monitor Site Traffic, Block Bad Users and Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2025Academy LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-59562 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Authorization Bypass Through User-Controlled Key vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.3.4.
Product
Academy LMS
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Delete User Accounts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58704 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows Stored XSS.This issue affects WP Delete User Accounts: from n/a through <= 1.2.4.
Product
WP Delete User Accounts
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update WP Delete User Accounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP User Frontend: Improper Control of Generation of Code ('Code Injection')CVE-2025-58673 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP User Frontend: from n/a through <= 4.1.12.
Product
WP User Frontend
Affected
up to 4.1.12
What to do
Affects up to 4.1.12. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP User Frontend: Missing AuthorizationCVE-2025-58672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.1.12.
Product
WP User Frontend
Affected
up to 4.1.12
What to do
Affects up to 4.1.12. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Front End Users: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58235 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.35.
Product
Front End Users
Affected
up to 3.2.35
What to do
Affects up to 3.2.35. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Content Mask: Authorization Bypass Through User-Controlled KeyCVE-2025-58012 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Mask: from n/a through <= 1.8.5.3.
Product
Content Mask
Affected
up to 1.8.5.3
What to do
Affects up to 1.8.5.3. Update Content Mask to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Upcoming Events Lists: Authorization Bypass Through User-Controlled KeyCVE-2025-57994 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Sayful Islam Upcoming Events Lists upcoming-events-lists allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upcoming Events Lists: from n/a through <= 1.4.0.
Product
Upcoming Events Lists
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Upcoming Events Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Open User Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map allows DOM-Based XSS.This issue affects Open User Map: from n/a through <= 1.4.14.
Product
Open User Map
Affected
up to 1.4.14
What to do
Affects up to 1.4.14. Update Open User Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 18, 2025Ninja Forms: Unserializes user input via form fieldCVE-2025-9083 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Product
Ninja Forms
Fixed in
3.11.1
What to do
Update Ninja Forms to 3.11.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 16, 2025User Sync – Remote User Sync: Cross-Site Request ForgeryCVE-2025-9891 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the mo_user_sync_form_handler() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
User Sync – Remote User Sync
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update User Sync – Remote User Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025User Meta – User Profile Builder and User management: Arbitrary file deletionCVE-2025-9693 · WordPress plugins & themes · reported by WordfenceHigh 8
The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
User Meta – User Profile Builder and User management
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update User Meta – User Profile Builder and User management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025Wp Edit Password Protected: Does not validate a parameter before redirecting the user to its valueCVE-2025-9034 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wp Edit Password Protected WordPress plugin before 1.3.5 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
Product
Wp Edit Password Protected
Fixed in
1.3.5
What to do
Update Wp Edit Password Protected to 1.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 8, 2025Doccure: Arbitrary User Password ChangeCVE-2025-9114 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
Product
Doccure
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Doccure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 5, 2025User Registration & Membership: SQL InjectionCVE-2025-9085 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
User Registration & Membership
What to do
Update User Registration & Membership to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2025UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Time-based SQL InjectionCVE-2025-10003 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘upload_file_remove’ function and 'htmlvar' parameter in all versions up to, and including, 1.2.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
Affected
up to 1.2.44
What to do
Affects up to 1.2.44. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 3, 2025wpForo Forum: Authorization Bypass Through User-Controlled KeyCVE-2025-58597 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.
Product
wpForo Forum
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: Stored Cross-Site ScriptingCVE-2025-9344 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwp_profile' and 'uwp_profile_header' shortcodes in all versions up to, and including, 1.2.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Affected
up to 1.2.42
What to do
Affects up to 1.2.42. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 23, 2025Case Theme User: Authentication BypassCVE-2025-5821 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly logging in a user with the data that was previously verified through the facebook_ajax_login_callback() function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
Product
Case Theme User
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Case Theme User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.