Vulnerability database

3,631 results · page 18 of 73

• Apr 9, 2025Ultra Demo Importer: Cross-Site Request Forgery (CSRF)CVE-2025-32496 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in Uncodethemes Ultra Demo Importer ut-demo-importer allows Upload a Web Shell to a Web Server.This issue affects Ultra Demo Importer: from n/a through <= 1.0.5.

  Product

  Ultra Demo Importer

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Ultra Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025reCAPTCHA Jetpack: Cross-Site Request Forgery (CSRF)CVE-2025-32494 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in bozdoz reCAPTCHA Jetpack recaptcha-jetpack allows Cross Site Request Forgery.This issue affects reCAPTCHA Jetpack: from n/a through <= 0.2.2.

  Product

  reCAPTCHA Jetpack

  Affected

  up to 0.2.2

  What to do

  Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP Performance Pack: Cross-Site Request Forgery (CSRF)CVE-2025-32485 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Cross Site Request Forgery.This issue affects WP Performance Pack: from n/a through <= 2.5.4.

  Product

  WP Performance Pack

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update WP Performance Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP-Planification: Cross-Site Request Forgery (CSRF)CVE-2025-32484 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WP-Planification wp-planification allows Stored XSS.This issue affects WP-Planification: from n/a through <= 2.3.1.

  Product

  WP-Planification

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update WP-Planification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Custom Smilies: Cross-Site Request Forgery (CSRF)CVE-2025-32482 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in quanganhdo Custom Smilies custom-smilies allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 1.2.

  Product

  Custom Smilies

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Custom Smilies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Nino Social Connect: Cross-Site Request Forgery (CSRF)CVE-2025-32481 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ninotheme Nino Social Connect nino-social-connect allows Stored XSS.This issue affects Nino Social Connect: from n/a through <= 2.0.

  Product

  Nino Social Connect

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Nino Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Windows Live Writer: Cross-Site Request Forgery (CSRF)CVE-2025-32480 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dalziel Windows Live Writer windows-live-writer allows Stored XSS.This issue affects Windows Live Writer: from n/a through <= 0.1.

  Product

  Windows Live Writer

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Windows Live Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Flags Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32479 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through <= 1.0.7.

  Product

  Flags Widget

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Flags Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP SexyLightBox: Cross-Site Request Forgery (CSRF)CVE-2025-32478 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a through <= 0.5.3.

  Product

  WP SexyLightBox

  Affected

  up to 0.5.3

  What to do

  Affects up to 0.5.3. Update WP SexyLightBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP-Easy Menu: Cross-Site Request Forgery (CSRF)CVE-2025-32477 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jordi Salord WP-Easy Menu wp-easy-menu allows Stored XSS.This issue affects WP-Easy Menu: from n/a through <= 0.41.

  Product

  WP-Easy Menu

  Affected

  up to 0.41

  What to do

  Affects up to 0.41. Update WP-Easy Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Advanced Tag Lists: Cross-Site Request Forgery (CSRF)CVE-2025-32476 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in blueinstyle Advanced Tag Lists advanced-tag-list allows Stored XSS.This issue affects Advanced Tag Lists: from n/a through <= 1.2.

  Product

  Advanced Tag Lists

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Advanced Tag Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025AF Tell a Friend: Cross-Site Request Forgery (CSRF)CVE-2025-31404 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Wladyslaw Madejczyk AF Tell a Friend af-tell-a-friend allows Stored XSS.This issue affects AF Tell a Friend: from n/a through <= 1.4.

  Product

  AF Tell a Friend

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update AF Tell a Friend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025NewsBoard Post and RSS Scroller: Cross-Site Request Forgery (CSRF)CVE-2025-31402 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in NewsBoard Plugin NewsBoard Post and RSS Scroller newsboard allows Stored XSS.This issue affects NewsBoard Post and RSS Scroller: from n/a through <= 1.2.12.

  Product

  NewsBoard Post and RSS Scroller

  Affected

  up to 1.2.12

  What to do

  Affects up to 1.2.12. Update NewsBoard Post and RSS Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025MMX – Make Me Christmas: Cross-Site Request Forgery (CSRF)CVE-2025-31401 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Christmas: from n/a through <= 1.0.0.

  Product

  MMX – Make Me Christmas

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update MMX – Make Me Christmas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WS Audio Player: Cross-Site Request Forgery (CSRF)CVE-2025-31400 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through <= 1.1.8.

  Product

  WS Audio Player

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update WS Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025CG Scroll To Top: Cross-Site Request Forgery (CSRF)CVE-2025-31399 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Chandan Garg CG Scroll To Top cg-scroll-to-top allows Stored XSS.This issue affects CG Scroll To Top: from n/a through <= 3.5.

  Product

  CG Scroll To Top

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update CG Scroll To Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Easy Custom CSS: Cross-Site Request Forgery (CSRF)CVE-2025-31395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Easy Custom CSS easy-custom-css allows Stored XSS.This issue affects Easy Custom CSS: from n/a through <= 1.0.

  Product

  Easy Custom CSS

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Easy Custom CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Social Bookmarking RELOADED: Cross-Site Request Forgery (CSRF)CVE-2025-31393 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in vfvalent Social Bookmarking RELOADED social-bookmarking-reloaded allows Stored XSS.This issue affects Social Bookmarking RELOADED: from n/a through <= 3.18.

  Product

  Social Bookmarking RELOADED

  Affected

  up to 3.18

  What to do

  Affects up to 3.18. Update Social Bookmarking RELOADED to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Smart Product Gallery Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31392 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shameem Reza Smart Product Gallery Slider smart-product-gallery-slider allows Cross Site Request Forgery.This issue affects Smart Product Gallery Slider: from n/a through <= 1.0.4.

  Product

  Smart Product Gallery Slider

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Smart Product Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Script Compressor: Cross-Site Request Forgery (CSRF)CVE-2025-31391 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in regen Script Compressor script-compressor allows Stored XSS.This issue affects Script Compressor: from n/a through <= 1.7.1.

  Product

  Script Compressor

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Script Compressor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Social Crowd: Cross-Site Request Forgery (CSRF)CVE-2025-31390 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bdoga Social Crowd social-crowd allows Stored XSS.This issue affects Social Crowd: from n/a through <= 0.9.6.1.

  Product

  Social Crowd

  Affected

  up to 0.9.6.1

  What to do

  Affects up to 0.9.6.1. Update Social Crowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025The World: Cross-Site Request Forgery (CSRF)CVE-2025-31388 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in doa The World the-world allows Stored XSS.This issue affects The World: from n/a through <= 0.4.

  Product

  The World

  Affected

  up to 0.4

  What to do

  Affects up to 0.4. Update The World to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Site Table of Contents: Cross-Site Request Forgery (CSRF)CVE-2025-31385 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in intelcaprep Site Table of Contents site-table-of-contents allows Stored XSS.This issue affects Site Table of Contents: from n/a through <= 0.3.

  Product

  Site Table of Contents

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Site Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025FrescoChat Live Chat: Cross-Site Request Forgery (CSRF)CVE-2025-31383 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sodena FrescoChat Live Chat flexytalk-widget allows Stored XSS.This issue affects FrescoChat Live Chat: from n/a through <= 3.2.6.

  Product

  FrescoChat Live Chat

  Affected

  up to 3.2.6

  What to do

  Affects up to 3.2.6. Update FrescoChat Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Language Field: Cross-Site Request Forgery (CSRF)CVE-2025-31382 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in theode Language Field language-field allows Stored XSS.This issue affects Language Field: from n/a through <= 0.9.

  Product

  Language Field

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Language Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Scheduled: Cross-Site Request Forgery (CSRF)CVE-2025-31375 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bhoogterp Scheduled scheduled allows Stored XSS.This issue affects Scheduled: from n/a through <= 1.0.

  Product

  Scheduled

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Scheduled to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Essential Breadcrumbs: Cross-Site Request Forgery (CSRF)CVE-2025-31038 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Essential Marketer Essential Breadcrumbs essential-breadcrumbs allows Privilege Escalation.This issue affects Essential Breadcrumbs: from n/a through <= 1.1.1.

  Product

  Essential Breadcrumbs

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Essential Breadcrumbs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WPSolr: Cross-Site Request Forgery (CSRF)CVE-2025-31036 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in WPSOLR WPSolr wpsolr-free allows Privilege Escalation.This issue affects WPSolr: from n/a through <= 24.0.

  Product

  WPSolr

  Affected

  up to 24.0

  What to do

  Affects up to 24.0. Update WPSolr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Customize Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-31034 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in AboZain Albanna Customize Login Page customize-login-page allows Cross Site Request Forgery.This issue affects Customize Login Page: from n/a through <= 1.1.

  Product

  Customize Login Page

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Buddypress Humanity: Cross-Site Request Forgery (CSRF)CVE-2025-31033 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Cross-Site Request Forgery (CSRF) vulnerability in Adam Nowak Buddypress Humanity buddypress-humanity allows Cross Site Request Forgery.This issue affects Buddypress Humanity: from n/a through <= 1.2.

  Product

  Buddypress Humanity

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Buddypress Humanity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Pagopar – WooCommerce Gateway: Cross-Site Request Forgery (CSRF)CVE-2025-31032 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Pagopar - Grupo M S.A. Pagopar – WooCommerce Gateway pagopar-woocommerce-gateway allows Stored XSS.This issue affects Pagopar – WooCommerce Gateway: from n/a through <= 2.7.1.

  Product

  Pagopar – WooCommerce Gateway

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update Pagopar – WooCommerce Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Comment Validation Reloaded: Cross-Site Request Forgery (CSRF)CVE-2025-31026 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment Validation Reloaded: from n/a through <= 0.5.

  Product

  Comment Validation Reloaded

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Comment Validation Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Seo Meta Tags: Cross-Site Request Forgery (CSRF)CVE-2025-31023 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Purab Seo Meta Tags seo-meta-tags allows Cross Site Request Forgery.This issue affects Seo Meta Tags: from n/a through <= 1.4.

  Product

  Seo Meta Tags

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Seo Meta Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Easyfonts: Cross-Site Request Forgery (CSRF)CVE-2025-31005 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Uzair Easyfonts easyfonts allows Cross Site Request Forgery.This issue affects Easyfonts: from n/a through <= 1.1.2.

  Product

  Easyfonts

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Easyfonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WordPress/Plugin Upgrade Time Out: Does not have CSRF check in some placesCVE-2024-8243 · WordPress plugins & themes · reported by WPScanMedium 6.3

  The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

  Product

  WordPress/Plugin Upgrade Time Out

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WordPress/Plugin Upgrade Time Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Apr 9, 2025WP MultiTasking: Does not have CSRF checkCVE-2024-6860 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack

  Product

  WP MultiTasking

  Affected

  up to 0.1.12

  What to do

  Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Apr 9, 2025WP MultiTasking: Does not have CSRF checkCVE-2024-6857 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack

  Product

  WP MultiTasking

  Affected

  up to 0.1.12

  What to do

  Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Apr 4, 2025WP Project Manager: Cross-Site Request Forgery (CSRF)CVE-2025-32280 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager wedevs-project-manager allows Cross Site Request Forgery.This issue affects WP Project Manager: from n/a through < 2.6.25.

  Product

  WP Project Manager

  Affected

  up to 2.6.22

  What to do

  Affects up to 2.6.22. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Table Block by RioVizual: Cross-Site Request Forgery (CSRF)CVE-2025-32278 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wprio Table Block by RioVizual riovizual allows Cross Site Request Forgery.This issue affects Table Block by RioVizual: from n/a through <= 2.3.1.

  Product

  Table Block by RioVizual

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Table Block by RioVizual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Administrator Z: Cross-Site Request Forgery (CSRF)CVE-2025-32276 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Quý Lê 91 Administrator Z administrator-z allows Cross Site Request Forgery.This issue affects Administrator Z: from n/a through <= 2026.03.02.

  Product

  Administrator Z

  Affected

  up to 2026.03.02

  What to do

  Affects up to 2026.03.02. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025WP w3all phpBB: Cross-Site Request Forgery (CSRF)CVE-2025-32274 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Cross Site Request Forgery.This issue affects WP w3all phpBB: from n/a through <= 2.9.8.

  Product

  WP w3all phpBB

  Affected

  up to 2.9.8

  What to do

  Affects up to 2.9.8. Update WP w3all phpBB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Freetobook Responsive Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32273 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in freetobook Freetobook Responsive Widget freetobook-responsive-widget allows Cross Site Request Forgery.This issue affects Freetobook Responsive Widget: from n/a through <= 1.1.

  Product

  Freetobook Responsive Widget

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Freetobook Responsive Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Wishlist: Cross-Site Request Forgery (CSRF)CVE-2025-32272 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Wishlist wishlist allows Cross Site Request Forgery.This issue affects Wishlist: from n/a through <= 1.0.46.

  Product

  Wishlist

  Affected

  up to 1.0.46

  What to do

  Affects up to 1.0.46. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Woocommerce Role Pricing: Cross-Site Request Forgery (CSRF)CVE-2025-32271 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Role Pricing woocommerce-role-pricing allows Cross Site Request Forgery.This issue affects Woocommerce Role Pricing: from n/a through <= 3.5.6.

  Product

  Woocommerce Role Pricing

  Affected

  up to 3.5.6

  What to do

  Affects up to 3.5.6. Update Woocommerce Role Pricing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Broadstreet Ads: Cross-Site Request Forgery (CSRF)CVE-2025-32270 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Broadstreet Broadstreet Ads broadstreet allows Cross Site Request Forgery.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.

  Product

  Broadstreet Ads

  Affected

  up to 1.52.1

  What to do

  Affects up to 1.52.1. Update Broadstreet Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2025-32269 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-zendesk allows Cross Site Request Forgery.This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.3.

  Product

  WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025QR Code Tag for WC: Cross-Site Request Forgery (CSRF)CVE-2025-32268 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in www.15.to QR Code Tag for WC qr-code-tag-for-wc-from-goaskle-com allows Cross Site Request Forgery.This issue affects QR Code Tag for WC: from n/a through <= 1.9.42.

  Product

  QR Code Tag for WC

  Affected

  up to 1.9.42

  What to do

  Affects up to 1.9.42. Update QR Code Tag for WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025Post to Social Media – WordPress to Hootsuite: Cross-Site Request Forgery (CSRF)CVE-2025-32267 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wpzinc Post to Social Media – WordPress to Hootsuite wp-to-hootsuite allows Cross Site Request Forgery.This issue affects Post to Social Media – WordPress to Hootsuite: from n/a through <= 1.5.8.

  Product

  Post to Social Media – WordPress to Hootsuite

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update Post to Social Media – WordPress to Hootsuite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025404 Image Redirection (Replace Broken Images): Cross-Site Request Forgery (CSRF)CVE-2025-32266 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) broken-images-redirection allows Cross Site Request Forgery.This issue affects 404 Image Redirection (Replace Broken Images): from n/a through <= 1.4.

  Product

  404 Image Redirection (Replace Broken Images)

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update 404 Image Redirection (Replace Broken Images) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 4, 2025JobWP: Cross-Site Request Forgery (CSRF)CVE-2025-32265 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.3.9.

  Product

  JobWP

  Affected

  up to 2.3.9

  What to do

  Affects up to 2.3.9. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.