Updated 0 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

24,332 results · page 183 of 487

Nov 12, 2025Import any XML, CSV or Excel File to WordPress (WP All Import): Remote Code ExecutionCVE-2025-12733 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution.
Product
Import any XML, CSV or Excel File to WordPress (WP All Import)
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update Import any XML, CSV or Excel File to WordPress (WP All Import) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025SureForms: Sensitive Information ExposureCVE-2025-12536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems.
Product
SureForms
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025Data Tables Generator by Supsystic: Arbitrary file deletionCVE-2025-12089 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Data Tables Generator by Supsystic
Affected
up to 1.10.45
What to do
Affects up to 1.10.45. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Privilege escalationCVE-2025-11923 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
What to do
Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 20250 Day Analytics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64293 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through <= 4.0.0.
Product
0 Day Analytics
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update 0 Day Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 12, 2025Easy Email Subscription: Stored Cross-Site ScriptingCVE-2025-11994 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Email Subscription
Affected
up to 1.3
What to do
Affects up to 1.3. Update Easy Email Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Nov 12, 2025Specific Content For Mobile – Customize the mobile version without redirections: SQL InjectionCVE-2025-11454 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is vulnerable to SQL Injection via the eos_scfm_duplicate_post_as_draft() function in all versions up to, and including, 0.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with COntributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Specific Content For Mobile – Customize the mobile version without redirections
Affected
up to 0.5.5
What to do
Affects up to 0.5.5. Update Specific Content For Mobile – Customize the mobile version without redirections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Payment Plugins Braintree For WooCommerce: Authorization bypassCVE-2025-12903 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/v1/3ds/vaulted_nonce REST API endpoint in all versions up to, and including, 3.2.78. This is due to the endpoint being registered with permission_callback set to __return_true and processing user-supplied token IDs without verifying ownership or authentication. This makes it possible for unauthenticated attackers to retrieve payment method nonces for any stored payment token in the system, which can be used to create fraudulent transactions, charge customer credit cards, or attach payment methods to other subscriptions.
Product
Payment Plugins Braintree For WooCommerce
Affected
up to 3.2.78
What to do
Affects up to 3.2.78. Update Payment Plugins Braintree For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025WP Import – Ultimate CSV XML Importer for: Unauthorized access of sensitive informationCVE-2025-12732 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including, 7.33. This makes it possible for authenticated attackers, with Author-level access or higher, to extract sensitive information including OpenAI API keys configured through the plugin's admin interface.
Product
WP Import – Ultimate CSV XML Importer for
Affected
up to 7.33
What to do
Affects up to 7.33. Update WP Import – Ultimate CSV XML Importer for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025Booking Calendar | Appointment Booking | Bookit: Unauthorized modification of dataCVE-2025-12633 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to connect their Stripe account and receive payments.
Product
Booking Calendar | Appointment Booking | Bookit
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Booking Calendar | Appointment Booking | Bookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Classified Listing – AI-Powered Classified ads & Business Directory: Unauthorized modification of dataCVE-2025-12953 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "rtcl_ajax_add_listing_type", "rtcl_ajax_update_listing_type", and "rtcl_ajax_delete_listing_type" function in all versions up to, and including, 5.2.0. This makes it possible for authenticated attackers, with subscriber level access and above, to add, update, or delete listing types.
Product
Classified Listing – AI-Powered Classified ads & Business Directory
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update Classified Listing – AI-Powered Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Blocksy Companion: Authenticated arbitrary file uploadCVE-2025-12846 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Blocksy Companion
Affected
up to 2.1.19
What to do
Affects up to 2.1.19. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Missing payment verification to unauthenticated payment bypassCVE-2025-12788 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.
Product
Hydra Booking — Appointment Scheduling & Booking Calendar
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update Hydra Booking — Appointment Scheduling & Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Unauthorized booking cancellationCVE-2025-12787 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhb_meeting_form_submit_callback" function using insufficiently random values to generate booking cancellation tokens, combined with a globally shared nonce. This makes it possible for unauthenticated attackers to cancel arbitrary bookings via brute force attacks against the tfhb_meeting_form_cencel AJAX endpoint.
Product
Hydra Booking — Appointment Scheduling & Booking Calendar
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update Hydra Booking — Appointment Scheduling & Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025TNC Toolbox: Web Performance: Sensitive Information ExposureCVE-2025-12539 · WordPress plugins & themes · reported by WordfenceCritical 10
The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment.
Product
TNC Toolbox: Web Performance
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update TNC Toolbox: Web Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Nov 11, 2025age-restriction: Does not have authorisation in the age_restrictionRemoteSupportRequest functionCVE-2025-11855 · WordPress plugins & themes · reported by WPScanHigh 7.5
The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password.
Product
age-restriction
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update age-restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 11, 2025WP Go Maps (formerly WP Google Maps): Does not sanitize user input provided via an AJAX actionCVE-2025-11307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.
Product
WP Go Maps (formerly WP Google Maps)
Fixed in
9.0.48
What to do
Update WP Go Maps (formerly WP Google Maps) to 9.0.48 or newer.
Full record and what to do →NVD record wpscan.com
Nov 11, 2025Make Email Customizer for WooCommerce: Lacks proper authorization checks and option validation in its AJAX actionsCVE-2025-11237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.
Product
Make Email Customizer for WooCommerce
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Make Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 10, 2025Holiday class post calendar: Remote Code ExecutionCVE-2025-12813 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.
Product
Holiday class post calendar
Affected
up to 7.1
What to do
Affects up to 7.1. Update Holiday class post calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Private Google Calendars: Unauthorized modification of dataCVE-2025-12526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgc_remove' action in all versions up to, and including, 20250811. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
Product
Private Google Calendars
Affected
up to 20250811
What to do
Affects up to 20250811. Update Private Google Calendars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Double the Donation – A workplace giving tool to help your fundraising efforts: Stored Cross-Site ScriptingCVE-2025-12020 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Double the Donation – A workplace giving tool to help your fundraising efforts
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Double the Donation – A workplace giving tool to help your fundraising efforts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Authors List: Sensitive Information ExposureCVE-2025-12010 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary method call from Authors_List_Shortcode class. This makes it possible for authenticated attackers, with Contributor-level access and above, to call methods such as get_meta to extract sensitive user data including password hashes, email addresses, usernames, and activation keys via specially crafted shortcode attributes
Product
Authors List
Affected
up to 2.0.6.1
What to do
Affects up to 2.0.6.1. Update Authors List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Add Multiple Marker: Unauthorized modification of data toCVE-2025-11999 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_reset_map() and amm_save_map_api() functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to update the map API and reset maps.
Product
Add Multiple Marker
Affected
up to 1.2
What to do
Affects up to 1.2. Update Add Multiple Marker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Document Pro Elementor – Documentation & Knowledge Base: Information ExposureCVE-2025-11997 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wp_localize_script without proper access restrictions. This makes it possible for unauthenticated attackers to view sensitive API keys in the page source, which could be leveraged to make unauthorized API calls to the configured Algolia search service.
Product
Document Pro Elementor – Documentation & Knowledge Base
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Document Pro Elementor – Documentation & Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Crypto: Unauthorized manipulation of dataCVE-2025-11988 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the crypto_delete_json method with only a publicly-available nonce check. This makes it possible for unauthenticated attackers to delete specific JSON files matching the pattern *_pending.json within the wp-content/uploads/yak/ directory, causing data loss and denial of service for plugin workflows that rely on these artifacts.
Product
Crypto
Affected
up to 2.22
What to do
Affects up to 2.22. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Crypto: Information exposureCVE-2025-11986 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the register and savenft methods with only a publicly-available nonce check and no wallet signature verification. This makes it possible for unauthenticated attackers to set a site-wide global authentication state via a single transient, bypassing all access controls for ALL visitors to the site. The impact is complete bypass of [crypto-block] shortcode restrictions and page-level access controls, affecting all site visitors for one hour, plus the ability to inject arbitrary data into the plugin's custom_users table.
Product
Crypto
Affected
up to 2.22
What to do
Affects up to 2.22. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Shelf Planner: Unauthorized modification of dataCVE-2025-11894 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings like the ServerKey and LicenseKey.
Product
Shelf Planner
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Shelf Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025Shelf Planner: Sensitive Information ExposureCVE-2025-11891 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shelf Planner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.
Product
Shelf Planner
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Shelf Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025Slippy Slider – Responsive Touch Navigation Slider: Stored Cross-Site ScriptingCVE-2025-11874 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Slippy Slider – Responsive Touch Navigation Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slippy-slider' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slippy Slider – Responsive Touch Navigation Slider
Affected
up to 2.0
What to do
Affects up to 2.0. Update Slippy Slider – Responsive Touch Navigation Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Paypal Donation Shortcode: Stored Cross-Site ScriptingCVE-2025-11859 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paypal Donation Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in all versions up to, and including, 0.1. This is due to the plugin not properly sanitizing user input and output of the 'title' and 'text' parameters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paypal Donation Shortcode
Affected
up to 0.1
What to do
Affects up to 0.1. Update Paypal Donation Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Magazine Companion: Stored Cross-Site ScriptingCVE-2025-11828 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using user-supplied values as HTML tag names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Magazine Companion
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Magazine Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce: Privilege EscalationCVE-2025-11457 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.0-beta2 to 1.8.2. This is due to the /easycommerce/v1/orders REST API endpoint not properly restricting the ability for users to select roles during registration. This makes it possible for unauthenticated attackers to gain administrator-level access to a vulnerable site.
Product
EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce
Affected
0.9.0-beta2 to 1.8.2
What to do
Affects 0.9.0-beta2 to 1.8.2. Update EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Mementor Core: Privilege EscalationCVE-2025-11168 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality.
Product
Mementor Core
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Mementor Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 8, 2025Alex Reservations: Smart Restaurant Booking: Arbitrary file uploadsCVE-2025-12399 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-json/srr/v1/app/upload/file REST endpoint in all versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Alex Reservations: Smart Restaurant Booking
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Alex Reservations: Smart Restaurant Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 8, 2025CYAN Backup: Arbitrary file deletionCVE-2025-12092 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CYAN Backup plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' functionality in all versions up to, and including, 2.5.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
CYAN Backup
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update CYAN Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 8, 2025Quick Featured Images: SQL InjectionCVE-2025-11980 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted they can convince an author-level user or higher to add a malicious custom field value.
Product
Quick Featured Images
Affected
up to 13.7.3
What to do
Affects up to 13.7.3. Update Quick Featured Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2025-11448 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries.
Product
Gallery Plugin for WordPress – Envira Photo Gallery
Affected
up to 1.11.0
What to do
Affects up to 1.11.0. Update Gallery Plugin for WordPress – Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 8, 2025Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: PHP Object InjectionCVE-2025-12099 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of untrusted input in the 'import_all_courses' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Sensitive Information ExposureCVE-2025-12098 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.8 via the 'enqueue_social_login_script' function. This makes it possible for unauthenticated attackers to extract sensitive data including the Facebook App Secret if Facebook Social Login is enabled.
Product
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record academylms.net wordfence.com
Nov 8, 2025Flexible Refund and Return Order for WooCommerce: Unauthorized modification of dataCVE-2025-12621 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.
Product
Flexible Refund and Return Order for WooCommerce
Affected
up to 1.0.42
What to do
Affects up to 1.0.42. Update Flexible Refund and Return Order for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized booking note creationCVE-2025-12498 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 4.2.0.0
What to do
Affects up to 4.2.0.0. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025Better Find and Replace – AI-Powered Suggestions: Limited Code InjectionCVE-2025-9334 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to call arbitrary plugin functions and execute code within those functions.
Product
Better Find and Replace – AI-Powered Suggestions
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Better Find and Replace – AI-Powered Suggestions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2025WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales: Unauthorized user registrationCVE-2025-12353 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.
Product
WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025Contact Form 7 AWeber Extension: Unauthorized modification of dataCVE-2025-12167 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_aweber_logreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the AWeber logs.
Product
Contact Form 7 AWeber Extension
Affected
up to 0.1.42
What to do
Affects up to 0.1.42. Update Contact Form 7 AWeber Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025WPFunnels: Arbitrary file deletionCVE-2025-12000 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WPFunnels
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2025Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: SQL InjectionCVE-2025-11972 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
Affected
up to 3.40.0
What to do
Affects up to 3.40.0. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Nov 7, 2025Simple Downloads List: Unauthorized modification of dataCVE-2025-12583 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint along with many others in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to alter many of the plugin's settings/downloads and inject malicious web scripts.
Product
Simple Downloads List
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Simple Downloads List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2025Asgaros Forum: SQL InjectionCVE-2025-11452 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Asgaros Forum
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Asgaros Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 7, 2025Page & Post Notes: Unauthorized modification of notesCVE-2025-12527 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes.
Product
Page & Post Notes
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Page & Post Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2025IDonate – Blood Donation, Request And Donor Management System: Insecure Direct Object ReferenceCVE-2025-4522 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. By supplying an arbitrary user_id parameter value to the wp_delete_user() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user accounts, including those of administrators.
Product
IDonate – Blood Donation, Request And Donor Management System
Affected
2.0.0 to 2.1.9
What to do
Affects 2.0.0 to 2.1.9. Update IDonate – Blood Donation, Request And Donor Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.