Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

2,520 results · page 18 of 51

Jul 10, 2025Lana Downloads Manager: Stored Cross-Site ScriptingCVE-2025-7387 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lana Downloads Manager
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update Lana Downloads Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 8, 2025Support Board: Unauthorized access/modification/deletion of dataCVE-2025-4855 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.
Product
Support Board
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Support Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 8, 2025Support Board: Arbitrary file deletionCVE-2025-4828 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can leverage CVE-2025-4855 vulnerability to exploit this vulnerability unauthenticated.
Product
Support Board
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Support Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 4, 2025FW Gallery: Unrestricted Upload of File with Dangerous TypeCVE-2025-49414 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Using Malicious Files.This issue affects FW Gallery: from n/a through <= 8.0.0.
Product
FW Gallery
Affected
up to 8.0.0
What to do
Affects up to 8.0.0. Update FW Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025LogisticsHub: Unrestricted Upload of File with Dangerous TypeCVE-2025-30933 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub logistics-hub allows Upload a Web Shell to a Web Server.This issue affects LogisticsHub: from n/a through <= 1.1.6.
Product
LogisticsHub
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update LogisticsHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Aviation Weather from NOAA: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-28980 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-noaa allows Path Traversal.This issue affects Aviation Weather from NOAA: from n/a through <= 0.7.2.
Product
Aviation Weather from NOAA
Affected
up to 0.7.2
What to do
Affects up to 0.7.2. Update Aviation Weather from NOAA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Bulk Featured Image: Unrestricted Upload of File with Dangerous TypeCVE-2025-28951 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.This issue affects Bulk Featured Image: from n/a through <= 1.2.4.
Product
Bulk Featured Image
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Bulk Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 3, 2025Download: Arbitrary file uploadsCVE-2025-6586 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_locInstall function in all versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Download
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jul 3, 2025VikRentCar Car Rental Management System: Arbitrary file uploadsCVE-2025-5322 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2025AiBud WP: Unrestricted Upload of File with Dangerous TypeCVE-2025-23968 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issue affects AiBud WP: from n/a through <= 1.9.
Product
AiBud WP
Affected
up to 1.9
What to do
Affects up to 1.9. Update AiBud WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 3, 2025Migration, Backup, Staging – WPvivid Backup & Migration: Arbitrary file uploadsCVE-2025-5961 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
Product
Migration, Backup, Staging – WPvivid Backup & Migration
Affected
up to 0.9.116
What to do
Affects up to 0.9.116. Update Migration, Backup, Staging – WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jul 2, 2025Drag and Drop Multiple File Upload (Pro) - WooCommerce: Arbitrary file uploadsCVE-2025-5746 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dnd_upload_cf7_upload_chunks() function in version 5.0 - 5.0.5 (when bundled with the PrintSpace theme) and all versions up to, and including, 1.7.1 (in the standalone version). This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The execution of PHP is disabled via a .htaccess file but is still possible in certain server configurations. CVE-2025-49885 may be a duplicate of this.
Product
Drag and Drop Multiple File Upload (Pro) - WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Drag and Drop Multiple File Upload (Pro) - WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codedropz.com wordfence.com
Jun 27, 2025Free Downloads EDD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53320 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wp Enhanced Free Downloads EDD allows DOM-Based XSS. This issue affects Free Downloads EDD: from n/a through 1.0.4.
Product
Free Downloads EDD
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Free Downloads EDD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Relocate Upload: Cross-Site Request Forgery (CSRF)CVE-2025-53315 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alanft Relocate Upload relocate-upload allows Stored XSS.This issue affects Relocate Upload: from n/a through <= 0.24.1.
Product
Relocate Upload
Affected
up to 0.24.1
What to do
Affects up to 0.24.1. Update Relocate Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Dashboard Widget Sidebar: Missing AuthorizationCVE-2025-53293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through <= 1.2.3.
Product
Dashboard Widget Sidebar
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Dashboard Widget Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025File Manager Plugin For: Unrestricted Upload of File with Dangerous TypeCVE-2025-53260 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in getredhawkstudio File Manager Plugin For Wordpress file-manager-plugin-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects File Manager Plugin For Wordpress: from n/a through <= 7.5.
Product
File Manager Plugin For
Affected
up to 7.5
What to do
Affects up to 7.5. Update File Manager Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Drag and Drop Multiple File Upload (Pro) - WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-49885 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-pro allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through <= 5.0.6.
Product
Drag and Drop Multiple File Upload (Pro) - WooCommerce
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Drag and Drop Multiple File Upload (Pro) - WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another userCVE-2025-5526 · WordPress plugins & themes · reported by WPScanMedium 4.3
The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user
Product
BuddyPress Docs
Fixed in
2.2.5
What to do
Update BuddyPress Docs to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 25, 2025The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server.CVE-2021-4457 · WordPress plugins & themes · reported by WPScanCritical 9.1
The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server.
Product
ZoomSounds
Fixed in
6.05
What to do
Update ZoomSounds to 6.05 or newer.
Full record and what to do →NVD record wpscan.com
Jun 24, 2025Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit: Arbitrary file uploadsCVE-2025-6206 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_image_editor_ajax_submit' function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. In order to exploit the vulnerability, there must be a value entered for the Stability.AI API key. The value can be arbitrary.
Product
Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jun 21, 2025wp-file-download: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-5034 · WordPress plugins & themes · reported by WPScanHigh 7.1
The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
wp-file-download
Fixed in
6.2.6
What to do
Update wp-file-download to 6.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2025WP Roadmap: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52822 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WP Roadmap wp-roadmap allows SQL Injection.This issue affects WP Roadmap: from n/a through <= 2.1.3.
Product
WP Roadmap
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update WP Roadmap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WP-DownloadCounter: Cross-Site Request Forgery (CSRF)CVE-2025-52790 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in r-win WP-DownloadCounter wp-downloadcounter allows Stored XSS.This issue affects WP-DownloadCounter: from n/a through <= 1.01.
Product
WP-DownloadCounter
Affected
up to 1.01
What to do
Affects up to 1.01. Update WP-DownloadCounter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Download Attachments: Authorization Bypass Through User-Controlled KeyCVE-2025-49995 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.3.1.
Product
Download Attachments
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Download Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Auto Upload Images: Server-Side Request Forgery (SSRF)CVE-2025-49985 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Ali Irani Auto Upload Images auto-upload-images allows Server Side Request Forgery.This issue affects Auto Upload Images: from n/a through <= 3.3.2.
Product
Auto Upload Images
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Auto Upload Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Beaver Builder Plugin (Starter Version): Arbitrary file uploadsCVE-2025-4102 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.
Product
Beaver Builder Plugin (Starter Version)
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Beaver Builder Plugin (Starter Version) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbeaverbuilder.com
Jun 19, 2025Download Manager: Stored Cross-Site ScriptingCVE-2025-4367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Manager
Affected
up to 3.3.18
What to do
Affects up to 3.3.18. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2025Ultra Addons for Contact Form 7: Arbitrary file uploadsCVE-2025-6220 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Ultra Addons for Contact Form 7
Affected
up to 3.5.12
What to do
Affects up to 3.5.12. Update Ultra Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 18, 2025CSV Me: Arbitrary file uploadsCVE-2025-6086 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csv_me_options_page' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
CSV Me
Affected
up to 2.0
What to do
Affects up to 2.0. Update CSV Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 17, 2025Pixabay Images: Arbitrary file uploadsCVE-2025-4413 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabay_upload function in all versions up to, and including, 3.4. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Pixabay Images
Affected
up to 3.4
What to do
Affects up to 3.4. Update Pixabay Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 17, 2025FW Food Menu: Unrestricted Upload of File with Dangerous TypeCVE-2025-49447 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects FW Food Menu : from n/a through 6.0.0.
Product
FW Food Menu
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update FW Food Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Reformer for Elementor: Unrestricted Upload of File with Dangerous TypeCVE-2025-49444 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server.This issue affects Reformer for Elementor: from n/a through <= 1.0.5.
Product
Reformer for Elementor
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Reformer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Flozen: Unrestricted Upload of File with Dangerous TypeCVE-2025-49071 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen flozen-theme allows Upload a Web Shell to a Web Server.This issue affects Flozen: from n/a through < 1.5.1.
Product
Flozen
What to do
Update Flozen to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025MapSVG: Unrestricted Upload of File with Dangerous TypeCVE-2025-47559 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through < 8.7.4.
Product
MapSVG
What to do
Update MapSVG to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025WP VR: Unrestricted Upload of File with Dangerous TypeCVE-2025-47452 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n/a through <= 8.5.26.
Product
WP VR
Affected
up to 8.5.26
What to do
Affects up to 8.5.26. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Ovatheme Events Manager: Unrestricted Upload of File with Dangerous TypeCVE-2025-32510 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue affects Ovatheme Events Manager: from n/a through <= 1.8.4.
Product
Ovatheme Events Manager
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Ovatheme Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Drag and Drop Multiple File Upload for Contact Form 7: Arbitrary file uploadsCVE-2025-3515 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.8.9
What to do
Affects up to 1.3.8.9. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 16, 2025WordPress Infinite Scroll – Ajax Load More: Stored Cross-Site ScriptingCVE-2025-4775 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Infinite Scroll – Ajax Load More
Affected
up to 7.4.0.1
What to do
Affects up to 7.4.0.1. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025File Manager Pro – Filester: Arbitrary file uploadsCVE-2025-3234 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.8.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Administrators have the ability to extend file manager usage privileges to lower-level users including subscribers, which would make this vulnerability more severe on such sites.
Product
File Manager Pro – Filester
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025WP Sliding Login/Dashboard Panel: Cross-Site Request ForgeryCVE-2025-5928 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Sliding Login/Dashboard Panel
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update WP Sliding Login/Dashboard Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file typCVE-2025-5012 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreap_temp_upload_to_media' function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 11, 2025WordPress Automatic: Arbitrary file uploadsCVE-2025-5395 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WordPress Automatic
Affected
up to 3.115.0
What to do
Affects up to 3.115.0. Update WordPress Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jun 11, 2025WP-DownloadManager: Arbitrary file deletionCVE-2025-4799 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability can be paired with CVE-2025-4798 to delete any file within the WordPress root directory.
Product
WP-DownloadManager
Affected
up to 1.68.10
What to do
Affects up to 1.68.10. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2025WP-DownloadManager: Arbitrary file readCVE-2025-4798 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restriction on the directory an administrator can select for storing downloads. This makes it possible for authenticated attackers, with Administrator-level access and above, to download and read any file on the server, including system and configuration files.
Product
WP-DownloadManager
Affected
up to 1.68.10
What to do
Affects up to 1.68.10. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2025WordPress-WPJobBoard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49455 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge WordPress-WPJobBoard click-pledge-wpjobboard allows Blind SQL Injection.This issue affects WordPress-WPJobBoard: from n/a through <= 25.07010000-WP6.8.1-JB5.11.5.
Product
WordPress-WPJobBoard
Affected
up to 25.07010000-WP6.8.1-JB5.11.5
What to do
Affects up to 25.07010000-WP6.8.1-JB5.11.5. Update WordPress-WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 10, 2025Axle Demo Importer: Does not validate files to be uploadedCVE-2025-4954 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server
Product
Axle Demo Importer
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Axle Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 10, 2025The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_CVE-2025-4387 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.
Affected
up to 9.16.0
What to do
Affects up to 9.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tychesoftwares.com tychesoftwares.com
Jun 9, 2025SUMO Affiliates Pro: Unrestricted Upload of File with Dangerous TypeCVE-2025-32291 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through < 11.1.0.
Product
SUMO Affiliates Pro
What to do
Update SUMO Affiliates Pro to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025Broadstreet: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-4652 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Broadstreet
Fixed in
1.51.8
What to do
Update Broadstreet to 1.51.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 6, 2025Store Locator: Unrestricted Upload of File with Dangerous TypeCVE-2025-49329 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Upload a Web Shell to a Web Server.This issue affects Store Locator WordPress: from n/a through <= 1.5.2.
Product
Store Locator
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.