Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

251 results · page 2 of 6

Dec 9, 2025WP Gravity Forms FreshDesk: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-67587 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Phishing.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
Product
WP Gravity Forms FreshDesk
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update WP Gravity Forms FreshDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Flexmls® IDX: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-67585 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Phishing.This issue affects Flexmls® IDX: from n/a through <= 3.15.7.
Product
Flexmls® IDX
Affected
up to 3.15.7
What to do
Affects up to 3.15.7. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2025Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: Time-based blind SQL InjectionCVE-2025-13922 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint in all versions up to, and including, 3.40.1. This is due to insufficient escaping on user-supplied parameters and lack of SQL query parameterization. This makes it possible for authenticated attackers, with Contributor-level access and above who have AI metabox permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, cause performance degradation, or enable data inference through time-based techniques.
Product
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
Affected
up to 3.40.1
What to do
Affects up to 3.40.1. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 3, 2025Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: Time-based SQL InjectionCVE-2025-13359 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database granted they have metabox access for the taxonomy (enabled by default for contributors).
Product
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
Affected
up to 3.40.1
What to do
Affects up to 3.40.1. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Dec 3, 2025Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: Authorization bypassCVE-2025-13354 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "taxopress_merge_terms_batch" function. This makes it possible for authenticated attackers, with subscriber level access and above, to merge or delete arbitrary taxonomy terms.
Product
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
Affected
up to 3.40.1
What to do
Affects up to 3.40.1. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Dec 3, 2025ShopEngine Elementor WooCommerce Builder Addon: Cross-Site Request ForgeryCVE-2025-12358 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "post_add_to_list" function as well as an incorrect permissions callback in the "Api/init" function. This makes it possible for unauthenticated attackers to add or remove products from a user's wishlist via a forged request granted they can trick a site's user into performing an action such as clicking on a link.
Product
ShopEngine Elementor WooCommerce Builder Addon
Affected
up to 4.8.5
What to do
Affects up to 4.8.5. Update ShopEngine Elementor WooCommerce Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2025S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator: Arbitrary file uploadsCVE-2025-12973 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeFile() function in all versions up to, and including, 1.7.8. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 21, 2025WP YouTube Lyte: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-66062 · WordPress plugins & themes · reported by PatchstackLow 3.4
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Frank Goossens WP YouTube Lyte wp-youtube-lyte allows Phishing.This issue affects WP YouTube Lyte: from n/a through <= 1.7.28.
Product
WP YouTube Lyte
Affected
up to 1.7.28
What to do
Affects up to 1.7.28. Update WP YouTube Lyte to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2025Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: SQL InjectionCVE-2025-11972 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
Affected
up to 3.40.0
What to do
Affects up to 3.40.0. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Oct 26, 2025WP Gravity Forms Zoho CRM and Bigin: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-62981 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.8.
Product
WP Gravity Forms Zoho CRM and Bigin
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Open Currency Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Open Currency Converter artiss-currency-converter allows Stored XSS.This issue affects Open Currency Converter: from n/a through <= 1.5.0.
Product
Open Currency Converter
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Open Currency Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Open Close WooCommerce Store: Missing AuthorizationCVE-2025-62935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Close WooCommerce Store: from n/a through <= 5.0.0.
Product
Open Close WooCommerce Store
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2025ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Unauthorized modification of dataCVE-2025-11888 · WordPress plugins & themes · reported by WordfenceLow 2.7
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.
Product
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
Affected
up to 4.8.4
What to do
Affects up to 4.8.4. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2025Open Source Genesis Framework: Stored Cross-Site ScriptingCVE-2025-10737 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Open Source Genesis Framework theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Open Source Genesis Framework
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Open Source Genesis Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record studiopress.github.io wordfence.com
Oct 22, 2025WP Gravity Forms HubSpot: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-60151 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.5.
Product
WP Gravity Forms HubSpot
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update WP Gravity Forms HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails: SQL InjectionCVE-2025-10047 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails
Affected
up to 5.3.15
What to do
Affects up to 5.3.15. Update Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 11, 2025CM Registration – Tailored tool for seamless login and invitation-based registrations: Open RedirectCVE-2025-11167 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via the 'redirect_url' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
CM Registration – Tailored tool for seamless login and invitation-based registrations
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update CM Registration – Tailored tool for seamless login and invitation-based registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 26, 2025ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Unauthorized accessCVE-2025-10173 · WordPress plugins & themes · reported by WordfenceLow 2.7
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings.
Product
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2025Events Manager – OpenStreetMaps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stonehenge Creations Events Manager – OpenStreetMaps stonehenge-em-osm allows Stored XSS.This issue affects Events Manager – OpenStreetMaps: from n/a through <= 4.2.1.
Product
Events Manager – OpenStreetMaps
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Events Manager – OpenStreetMaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Gravity Forms Keap/Infusionsoft: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-58006 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Phishing.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.6.
Product
WP Gravity Forms Keap/Infusionsoft
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update WP Gravity Forms Keap/Infusionsoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Open User Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map allows DOM-Based XSS.This issue affects Open User Map: from n/a through <= 1.4.14.
Product
Open User Map
Affected
up to 1.4.14
What to do
Affects up to 1.4.14. Update Open User Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2025CBX Map for Google Map & OpenStreetMap: Stored Cross-Site ScriptingCVE-2025-9123 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CBX Map for Google Map & OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup heading and location address parameters in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CBX Map for Google Map & OpenStreetMap
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update CBX Map for Google Map & OpenStreetMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 9, 2025GoodBarber: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39523 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber goodbarber.This issue affects GoodBarber: from n/a through <= 1.0.26.
Product
GoodBarber
Affected
up to 1.0.26
What to do
Affects up to 1.0.26. Update GoodBarber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025Podlove Podcast Publisher: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-58204 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Phishing.This issue affects Podlove Podcast Publisher: from n/a through <= 4.2.5.
Product
Podlove Podcast Publisher
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Connector for Gravity Forms and Google Sheets: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-54681 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Phishing.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.4.
Product
Connector for Gravity Forms and Google Sheets
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Connector for Gravity Forms and Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 8, 2025OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-6572 · WordPress plugins & themes · reported by WPScanMedium 5.9
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI pluginCVE-2025-7725 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment feature in all versions up to, and including, 26.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.1.0
What to do
Affects up to 26.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 11, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI pluginCVE-2025-6716 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'upload[1][title]' parameter in all versions up to, and including, 26.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.0.8
What to do
Affects up to 26.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 3, 2025AI Engine: Open redirect in version 2CVE-2025-6238 · WordPress plugins & themes · reported by WordfenceHigh 8
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.
Product
AI Engine
Affected
2.8.4 to 2.8.4
What to do
Affects 2.8.4 to 2.8.4. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2025FunnelKit Automations: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-49868 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.6.0.
Product
FunnelKit Automations
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Newspack Newsletters: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-49325 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Newspack Newsletters: from n/a through <= 3.13.0.
Product
Newspack Newsletters
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update Newspack Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025WP Gravity Forms Constant Contact: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30954 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.0.
Product
WP Gravity Forms Constant Contact
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WP Gravity Forms Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025WP Gravity Forms Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30953 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.4.7.
Product
WP Gravity Forms Salesforce
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update WP Gravity Forms Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 3, 2025Bit File Manager – 100% Free & Open Source File Manager and Code Editor for: Stored Cross-Site ScriptingCVE-2025-1725 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for
Affected
up to 6.7
What to do
Affects up to 6.7. Update Bit File Manager – 100% Free & Open Source File Manager and Code Editor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 30, 2025OpenSheetMusicDisplay: Stored Cross-Site ScriptingCVE-2025-5235 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
OpenSheetMusicDisplay
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update OpenSheetMusicDisplay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 21, 2025Affiliate Sales in Google Analytics and other tools: Open RedirectCVE-2024-12561 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This is due to insufficient validation on the redirect url supplied via the 'afflink' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
Affiliate Sales in Google Analytics and other tools
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Affiliate Sales in Google Analytics and other tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2025wccp-pro: Contains an open-redirect flaw via the referrer parameterCVE-2024-6690 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites
Product
wccp-pro
Fixed in
15.3
What to do
Update wccp-pro to 15.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 7, 2025CBX Map for Google Map & OpenStreetMap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47669 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabuj Kundu CBX Map for Google Map & OpenStreetMap cbxgooglemap allows DOM-Based XSS.This issue affects CBX Map for Google Map & OpenStreetMap: from n/a through <= 1.1.12.
Product
CBX Map for Google Map & OpenStreetMap
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update CBX Map for Google Map & OpenStreetMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Open Close WooCommerce Store: Path Traversal: '.../...//'CVE-2025-47649 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.9.
Product
Open Close WooCommerce Store
Affected
up to 4.9.9
What to do
Affects up to 4.9.9. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Integrations of Zoho CRM with Elementor form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47644 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-with-elementor-form allows Phishing.This issue affects Integrations of Zoho CRM with Elementor form: from n/a through <= 1.0.8.
Product
Integrations of Zoho CRM with Elementor form
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Integrations of Zoho CRM with Elementor form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025WP Gravity Forms Zendesk: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47456 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.
Product
WP Gravity Forms Zendesk
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Gravity Forms Zendesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Integration for WooCommerce and Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n/a through <= 1.7.5.
Product
Integration for WooCommerce and Salesforce
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Integration for WooCommerce and Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025WP Gravity Forms Dynamics CRM: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47454 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.
Product
WP Gravity Forms Dynamics CRM
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update WP Gravity Forms Dynamics CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Sassy Social Share: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39404 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Phishing.This issue affects Sassy Social Share: from n/a through <= 3.3.73.
Product
Sassy Social Share
Affected
up to 3.3.73
What to do
Affects up to 3.3.73. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Listdom: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39599 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Webilia Inc. Listdom listdom allows Phishing.This issue affects Listdom: from n/a through <= 4.0.0.
Product
Listdom
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Listdom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Fast eBay Listings: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39597 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Arthur Yarwood Fast eBay Listings fast-ebay-listings allows Phishing.This issue affects Fast eBay Listings: from n/a through <= 2.12.15.
Product
Fast eBay Listings
Affected
up to 2.12.15
What to do
Affects up to 2.12.15. Update Fast eBay Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025Accredible Certificates & Open Badges: Time-based SQL InjectionCVE-2024-13909 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Accredible Certificates & Open Badges plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Accredible Certificates & Open Badges
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Accredible Certificates & Open Badges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2025Ultimate WP Mail: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-32694 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Phishing.This issue affects Ultimate WP Mail: from n/a through <= 1.3.10.
Product
Ultimate WP Mail
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WebinarPress: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-32693 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Phishing.This issue affects WebinarPress: from n/a through <= 1.33.28.
Product
WebinarPress
Affected
up to 1.33.28
What to do
Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2025Advanced Advertising System: Open RedirectCVE-2025-3433 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced Advertising System plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.3.1. This is due to insufficient validation on the redirect url supplied via the 'redir' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
Advanced Advertising System
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Advanced Advertising System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.