Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

24,332 results · page 188 of 487

Oct 31, 2025WordPress User Extra Fields: Arbitrary file deletionCVE-2025-7846 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WordPress User Extra Fields
Affected
up to 16.7
What to do
Affects up to 16.7. Update WordPress User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 31, 2025Noo JobMonster: Authentication BypassCVE-2025-5397 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers to bypass standard authentication and access administrative user accounts. Please note social login needs to be enabled in order for a site to be impacted by this vulnerability.
Product
Noo JobMonster
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update Noo JobMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 31, 2025RealPress: Registers the REST routes without proper permission checksCVE-2025-11191 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site.
Product
RealPress
Fixed in
1.1.0
What to do
Update RealPress to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 30, 2025FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.): Unauthorized modification of dataCVE-2025-11975 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_changes() function in all versions up to, and including, 1.1.23.0. This makes it possible for unauthenticated attackers to add and edit sync rules.
Product
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)
Affected
up to 1.1.23.0
What to do
Affects up to 1.1.23.0. Update FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 30, 2025Blocksy Companion: Stored Cross-Site ScriptingCVE-2025-12475 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shortcode in all versions up to, and including, 2.1.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Blocksy Companion
Affected
up to 2.1.14
What to do
Affects up to 2.1.14. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 29, 2025Call Now Button – The #1 Click to Call Button for: Unauthorized modification of dataCVE-2025-11587 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to link the plugin to their nowbuttons.com account and add malicious buttons to the site. The vulnerability is only exploitable on fresh installs where the plugin has not been previously configured with an API key.
Product
Call Now Button – The #1 Click to Call Button for
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Call Now Button – The #1 Click to Call Button for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 29, 2025Easy Testimonial Slider and Form: SQL InjectionCVE-2015-10147 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Easy Testimonial Slider and Form
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Easy Testimonial Slider and Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 29, 2025Thumbnail Slider With Lightbox: SQL InjectionCVE-2015-10146 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Thumbnail Slider With Lightbox
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Thumbnail Slider With Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 29, 2025Premmerce User Roles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64291 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Stored XSS.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.
Product
Premmerce User Roles
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Premmerce User Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Premmerce Product Search for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64289 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Stored XSS.This issue affects Premmerce Product Search for WooCommerce: from n/a through 2.2.7.
Product
Premmerce Product Search for WooCommerce
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Premmerce Product Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Premmerce Wholesale Pricing for WooCommerce: Missing AuthorizationCVE-2025-64285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Wholesale Pricing for WooCommerce: from n/a through <= 1.1.10.
Product
Premmerce Wholesale Pricing for WooCommerce
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Premmerce Wholesale Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Majestic Support: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64284 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PHP Local File Inclusion.This issue affects Majestic Support: from n/a through <= 1.0.7.
Product
Majestic Support
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025RTMKit: Authorization Bypass Through User-Controlled KeyCVE-2025-64283 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RTMKit: from n/a through <= 1.6.7.
Product
RTMKit
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Evergreen Content Poster: Missing AuthorizationCVE-2025-64234 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Evergreen Content Poster: from n/a through <= 1.4.5.
Product
Evergreen Content Poster
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Evergreen Content Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2025-64229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.7
What to do
Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025SUMO Affiliates Pro: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64228 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded Sensitive Data.This issue affects SUMO Affiliates Pro: from n/a through <= 11.0.0.
Product
SUMO Affiliates Pro
Affected
up to 11.0.0
What to do
Affects up to 11.0.0. Update SUMO Affiliates Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Rey Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64220 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReyCommerce Rey Core rey-core allows Stored XSS.This issue affects Rey Core: from n/a through <= 3.1.8.
Product
Rey Core
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Rey Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Business Directory: Missing AuthorizationCVE-2025-64219 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through <= 6.4.18.
Product
Business Directory
Affected
up to 6.4.18
What to do
Affects up to 6.4.18. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025SmartMag: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64216 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeSphere SmartMag smart-mag allows PHP Local File Inclusion.This issue affects SmartMag: from n/a through <= 10.3.0.
Product
SmartMag
Affected
up to 10.3.0
What to do
Affects up to 10.3.0. Update SmartMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025MasterStudy LMS Pro: Missing AuthorizationCVE-2025-64212 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
Product
MasterStudy LMS Pro
What to do
Update MasterStudy LMS Pro to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Masterstudy Elementor Widgets: Missing AuthorizationCVE-2025-64211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4.
Product
Masterstudy Elementor Widgets
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Masterstudy Elementor Widgets: Missing AuthorizationCVE-2025-64210 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4.
Product
Masterstudy Elementor Widgets
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Jannah - Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64208 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah - Extensions jannah-extensions allows DOM-Based XSS.This issue affects Jannah - Extensions: from n/a through <= 1.1.4.
Product
Jannah - Extensions
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Jannah - Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025SmartMag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64204 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeSphere SmartMag smart-mag allows Stored XSS.This issue affects SmartMag: from n/a through <= 10.3.1.
Product
SmartMag
Affected
up to 10.3.1
What to do
Affects up to 10.3.1. Update SmartMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Sahifa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64202 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Sahifa sahifa allows DOM-Based XSS.This issue affects Sahifa: from n/a through < 5.8.6.
Product
Sahifa
What to do
Update Sahifa to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Email Template Customizer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64200 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through <= 1.2.17.
Product
Email Template Customizer for WooCommerce
Affected
up to 1.2.17
What to do
Affects up to 1.2.17. Update Email Template Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025wpresidence: Missing AuthorizationCVE-2025-64199 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through <= 5.3.2.
Product
wpresidence
Affected
up to 5.3.2
What to do
Affects up to 5.3.2. Update wpresidence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Rehub: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64197 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through < 19.9.9.1.
Product
Rehub
What to do
Update Rehub to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Eduma: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64195 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress Eduma eduma allows PHP Local File Inclusion.This issue affects Eduma: from n/a through <= 5.7.6.
Product
Eduma
Affected
up to 5.7.6
What to do
Affects up to 5.7.6. Update Eduma to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Eduma: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64194 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affects Eduma: from n/a through <= 5.7.6.
Product
Eduma
Affected
up to 5.7.6
What to do
Affects up to 5.7.6. Update Eduma to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Blog Designer PRO: Missing AuthorizationCVE-2025-58711 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blog Designer PRO: from n/a through <= 3.4.8.
Product
Blog Designer PRO
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025WooCommerce: Sensitive Information ExposureCVE-2023-7320 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unauthenticated attackers to extract sensitive user information including PII(Personal Identifiable Information).
Product
WooCommerce
Affected
up to 7.8.2
What to do
Affects up to 7.8.2. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 29, 2025Doppler Forms: Registers an AJAX action install_extension without verifying user capabilities or using a nonceCVE-2025-9544 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).
Product
Doppler Forms
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 29, 2025WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49042 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2.
Product
WooCommerce
Affected
up to 10.0.2
What to do
Affects up to 10.0.2. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Facebook for WooCommerce: Missing AuthorizationCVE-2025-64296 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
Product
Facebook for WooCommerce
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Facebook for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2025WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecCVE-2025-4665 · WordPress plugins & themes · reported by mandiant-cve@google.comCritical 9.6
WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Oct 28, 2025HUSKY – Products Filter Professional for WooCommerce: Blind SQL InjectionCVE-2025-11735 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.7.1
What to do
Affects up to 1.3.7.1. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 27, 2025IDonate: Does not have authorisation and CSRFCVE-2025-11154 · WordPress plugins & themes · reported by WPScanMedium 5.4
The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.
Product
IDonate
Fixed in
2.1.13
What to do
Update IDonate to 2.1.13 or newer.
Full record and what to do →NVD record wpscan.com
Oct 26, 2025Ultimate Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48088 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Stored XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through < 3.21.1.
Product
Ultimate Addons for WPBakery Page Builder
What to do
Update Ultimate Addons for WPBakery Page Builder to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Builderall Builder for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62987 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Builderall Builderall Builder for WordPress builderall-cheetah-for-wp allows Stored XSS.This issue affects Builderall Builder for WordPress: from n/a through <= 3.0.1.
Product
Builderall Builder for
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Builderall Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Simple Pull Quote: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62985 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in llamaman Simple Pull Quote simple-pull-quote allows Stored XSS.This issue affects Simple Pull Quote: from n/a through <= 1.6.3.
Product
Simple Pull Quote
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Simple Pull Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025WP AdCenter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62984 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through <= 2.6.1.
Product
WP AdCenter
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update WP AdCenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Posts By Tag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62983 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu Posts By Tag posts-by-tag allows Stored XSS.This issue affects Posts By Tag: from n/a through <= 3.2.1.
Product
Posts By Tag
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Posts By Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Dynamic User Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62982 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dynamic User Directory: from n/a through <= 2.3.
Product
Dynamic User Directory
Affected
up to 2.3
What to do
Affects up to 2.3. Update Dynamic User Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025WP Gravity Forms Zoho CRM and Bigin: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-62981 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.8.
Product
WP Gravity Forms Zoho CRM and Bigin
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Persian Admnin Fonts: Missing AuthorizationCVE-2025-62980 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MDZ Persian Admnin Fonts persian-admin-fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Persian Admnin Fonts: from n/a through <= 4.1.03.
Product
Persian Admnin Fonts
Affected
up to 4.1.03
What to do
Affects up to 4.1.03. Update Persian Admnin Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025ACF to REST API: Insertion of Sensitive Information Into Sent DataCVE-2025-62979 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in airesvsg ACF to REST API acf-to-rest-api allows Retrieve Embedded Sensitive Data.This issue affects ACF to REST API: from n/a through <= 3.3.4.
Product
ACF to REST API
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update ACF to REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025KiotViet Sync: Missing AuthorizationCVE-2025-62978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5.
Product
KiotViet Sync
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025百度站长SEO合集(支持百度/神马/Bing/头条推送): Missing AuthorizationCVE-2025-62977 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 沃之涛百度站长SEO合集(支持百度/神马/Bing/头条推送) baiduseo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 百度站长SEO合集(支持百度/神马/Bing/头条推送): from n/a through <= 2.1.4.
Product
百度站长SEO合集(支持百度/神马/Bing/头条推送)
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update 百度站长SEO合集(支持百度/神马/Bing/头条推送) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Sendle Shipping: Missing AuthorizationCVE-2025-62976 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sendle Shipping: from n/a through <= 6.02.
Product
Sendle Shipping
Affected
up to 6.02
What to do
Affects up to 6.02. Update Sendle Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.