Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

453new WordPress flaws this week

394,547entries in the database

24,491 results · page 238 of 490

May 23, 2025Dash: Deserialization of Untrusted DataCVE-2025-31049 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3.
Product
Dash
Affected
up to 1.3
What to do
Affects up to 1.3. Update Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 21, 2025Glossary by WPPedia – Best Glossary plugin for: PHP Object InjectionCVE-2025-4803 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.0 via deserialization of untrusted input from the 'posttypes' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Glossary by WPPedia – Best Glossary plugin for
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Glossary by WPPedia – Best Glossary plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 21, 2025Splitit: Unauthorized modification of dataCVE-2025-4105 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gateway.php' file in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change plugin settings, including changing the environment from sandbox to production and vice versa.
Product
Splitit
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update Splitit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2025Raisely Donation Form: Stored Cross-Site ScriptingCVE-2025-3781 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Raisely Donation Form
Affected
up to 1.1
What to do
Affects up to 1.1. Update Raisely Donation Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2025Madara – Responsive and modern WordPress theme for manga sites: Local File InclusionCVE-2025-4524 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Madara – Responsive and modern WordPress theme for manga sites
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Madara – Responsive and modern WordPress theme for manga sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mangabooth.com wordfence.com
May 21, 2025DIGITS: WordPress Mobile Number Signup and Login: Does not rate limit OTP validation attemptsCVE-2025-4094 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
Product
DIGITS: WordPress Mobile Number Signup and Login
Fixed in
8.4.6.1
What to do
Update DIGITS: WordPress Mobile Number Signup and Login to 8.4.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 20, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in varioCVE-2024-5878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 20, 2025Motors: Privilege escalationCVE-2025-4322 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.
Product
Motors
Affected
up to 5.6.67
What to do
Affects up to 5.6.67. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 19, 2025Section Widget: Path Traversal: '.../...//'CVE-2025-46441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Path Traversal: '.../...//' vulnerability in ctltwp Section Widget section-widget allows Path Traversal.This issue affects Section Widget: from n/a through <= 3.3.1.
Product
Section Widget
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Section Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39395 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
Product
WPAMS
Affected
up to 44.0
What to do
Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Hospital Management System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39393 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management allows Reflected XSS.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
Product
Hospital Management System
Affected
up to 47.0
What to do
Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPAMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39392 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
Product
WPAMS
Affected
up to 44.0
What to do
Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025AnalyticsWP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39389 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solid Plugins AnalyticsWP allows SQL Injection.This issue affects AnalyticsWP: from n/a through 2.1.2.
Product
AnalyticsWP
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update AnalyticsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39386 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management allows SQL Injection.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
Product
Hospital Management System
Affected
up to 47.0
What to do
Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WordPress Events Calendar Registration & Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39372 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Reflected XSS.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
Product
WordPress Events Calendar Registration & Tickets
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025wProject: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39365 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affects wProject: from n/a before 5.8.0.
Product
wProject
Fixed in
5.8.0
What to do
Update wProject to 5.8.0 or newer.
Full record and what to do →NVD record patchstack.com
May 19, 2025Hospital Management System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39357 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management allows SQL Injection.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
Product
Hospital Management System
Affected
up to 47.0
What to do
Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Foodbakery Sticky Cart: Deserialization of Untrusted DataCVE-2025-39356 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through <= 3.2.
Product
Foodbakery Sticky Cart
Affected
up to 3.2
What to do
Affects up to 3.2. Update Foodbakery Sticky Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025FAT Services Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39355 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking allows SQL Injection.This issue affects FAT Services Booking: from n/a through <= 5.6.
Product
FAT Services Booking
Affected
up to 5.6
What to do
Affects up to 5.6. Update FAT Services Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Grand Conference: Deserialization of Untrusted DataCVE-2025-39354 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: from n/a through <= 5.3.
Product
Grand Conference
Affected
up to 5.3
What to do
Affects up to 5.3. Update Grand Conference to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Grand Restaurant: Missing AuthorizationCVE-2025-39352 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.
Product
Grand Restaurant
Affected
up to 7.0
What to do
Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025wProject: Missing AuthorizationCVE-2025-39350 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0.
Product
wProject
Fixed in
5.8.0
What to do
Update wProject to 5.8.0 or newer.
Full record and what to do →NVD record patchstack.com
May 19, 2025CiyaShop: Deserialization of Untrusted DataCVE-2025-39349 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaShop: from n/a through <= 4.18.0.
Product
CiyaShop
Affected
up to 4.18.0
What to do
Affects up to 4.18.0. Update CiyaShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Grand Restaurant: Deserialization of Untrusted DataCVE-2025-39348 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.
Product
Grand Restaurant
Affected
up to 7.0
What to do
Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Altair: Deserialization of Untrusted DataCVE-2025-32928 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2.
Product
Altair
Affected
up to 5.2.2
What to do
Affects up to 5.2.2. Update Altair to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025FoodBakery: Deserialization of Untrusted DataCVE-2025-32927 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through <= 3.3.
Product
FoodBakery
Affected
up to 3.3
What to do
Affects up to 3.3. Update FoodBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Grand Restaurant: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32926 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects Grand Restaurant: from n/a through <= 7.0.
Product
Grand Restaurant
Affected
up to 7.0
What to do
Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025SUMO Reward Points: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32925 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points rewardsystem allows PHP Local File Inclusion.This issue affects SUMO Reward Points: from n/a through <= 30.7.0.
Product
SUMO Reward Points
Affected
up to 30.7.0
What to do
Affects up to 30.7.0. Update SUMO Reward Points to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Revy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32924 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy allows SQL Injection.This issue affects Revy: from n/a through <= 2.1.
Product
Revy
Affected
up to 2.1
What to do
Affects up to 2.1. Update Revy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Tiger: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31027 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jocoxdesign Tiger tiger allows Reflected XSS.This issue affects Tiger: from n/a through 2.0.
Product
Tiger
Affected
up to 2.0
What to do
Affects up to 2.0. Update Tiger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WordPress Events Calendar Registration & Tickets: Deserialization of Untrusted DataCVE-2025-47581 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
Product
WordPress Events Calendar Registration & Tickets
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025BP Messages Tool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43839 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Messages Tool bp-messages-tool allows Reflected XSS.This issue affects BP Messages Tool: from n/a through <= 2.2.
Product
BP Messages Tool
Affected
up to 2.2
What to do
Affects up to 2.2. Update BP Messages Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Custom PC Builder Lite for WooCommerce: Missing AuthorizationCVE-2025-43838 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ChoPlugins.com Custom PC Builder Lite for WooCommerce custom-pc-builder-lite-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom PC Builder Lite for WooCommerce: from n/a through <= 1.0.1.
Product
Custom PC Builder Lite for WooCommerce
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Custom PC Builder Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Total Donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43837 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binti76 Total Donations total-donations allows Reflected XSS.This issue affects Total Donations: from n/a through <= 3.0.8.
Product
Total Donations
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Total Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Syndicate Out: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43836 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in confuzzledduck Syndicate Out syndicate-out allows Reflected XSS.This issue affects Syndicate Out: from n/a through <= 0.9.
Product
Syndicate Out
Affected
up to 0.9
What to do
Affects up to 0.9. Update Syndicate Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Remote Images Grabber: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43832 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyk Remote Images Grabber remote-images-grabber allows Reflected XSS.This issue affects Remote Images Grabber: from n/a through <= 0.6.
Product
Remote Images Grabber
Affected
up to 0.6
What to do
Affects up to 0.6. Update Remote Images Grabber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Foton: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39458 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Foton foton allows PHP Local File Inclusion.This issue affects Foton: from n/a through <= 2.5.2.
Product
Foton
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Foton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025JetBlocks For Elementor: Missing AuthorizationCVE-2025-39451 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.16.
Product
JetBlocks For Elementor
Affected
up to 1.3.16
What to do
Affects up to 1.3.16. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025JetWooBuilder: Missing AuthorizationCVE-2025-39449 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetWooBuilder: from n/a through <= 2.1.18.
Product
JetWooBuilder
Affected
up to 2.1.18
What to do
Affects up to 2.1.18. Update JetWooBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025JetElements For Elementor: Missing AuthorizationCVE-2025-39447 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetElements For Elementor jet-elements allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.
Product
JetElements For Elementor
Affected
up to 2.7.4.1
What to do
Affects up to 2.7.4.1. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Booster Plus for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39446 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflected XSS.This issue affects Booster Plus for WooCommerce: from n/a through 7.2.4.
Product
Booster Plus for WooCommerce
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update Booster Plus for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Super Store Finder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39445 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.2.
Product
Super Store Finder
Affected
up to 7.2
What to do
Affects up to 7.2. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WhatsApp Click to Chat Plugin for: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39411 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress wpt-whatsapp.This issue affects WhatsApp Click to Chat Plugin for WordPress: from n/a through <= 2.2.12.
Product
WhatsApp Click to Chat Plugin for
Affected
up to 2.2.12
What to do
Affects up to 2.2.12. Update WhatsApp Click to Chat Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Smart Sections Theme Builder - WPBakery Page Builder Addon: Deserialization of Untrusted DataCVE-2025-39410 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Theme Builder - WPBakery Page Builder Addon: from n/a through 1.7.8.
Product
Smart Sections Theme Builder - WPBakery Page Builder Addon
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Smart Sections Theme Builder - WPBakery Page Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WordPress Video Robot - The Ultimate Video Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39409 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0.
Product
WordPress Video Robot - The Ultimate Video Importer
Affected
up to 1.20.0
What to do
Affects up to 1.20.0. Update WordPress Video Robot - The Ultimate Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Memberpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39407 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caseproof, LLC Memberpress allows Reflected XSS.This issue affects Memberpress: from n/a before 1.12.0.
Product
Memberpress
Fixed in
1.12.0
What to do
Update Memberpress to 1.12.0 or newer.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPAMS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39406 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPAMS apartment-management allows PHP Local File Inclusion.This issue affects WPAMS: from n/a through <= 44.0.
Product
WPAMS
Affected
up to 44.0
What to do
Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39403 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
Product
WPAMS
Affected
up to 44.0
What to do
Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPBot Pro Wordpress Chatbot: Deserialization of Untrusted DataCVE-2025-47582 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chatbot: from n/a through 12.7.0.
Product
WPBot Pro Wordpress Chatbot
Affected
up to 12.7.0
What to do
Affects up to 12.7.0. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WP Vegas: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-43841 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jamesdbruner WP Vegas vegas-fullscreen-background-slider allows Stored XSS.This issue affects WP Vegas: from n/a through <= 2.2.
Product
WP Vegas
Affected
up to 2.2
What to do
Affects up to 2.2. Update WP Vegas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.