Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

41,225 results · page 251 of 825

Dec 13, 2025Devs CRM – Manage tasks, attendance and teams all together: Unauthorized access of dataCVE-2025-13092 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API Endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to retrieve private user data, including password hashes.
Product
Devs CRM – Manage tasks, attendance and teams all together
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Devs CRM – Manage tasks, attendance and teams all together to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 13, 2025WP Directory Kit: SQL InjectionCVE-2025-13089 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Directory Kit
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce: Time-based blind SQL InjectionCVE-2025-13077 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record owasp.org plugins.trac.wordpress.org
Dec 13, 2025GenerateBlocks: Information exposureCVE-2025-12512 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GenerateBlocks plugin for WordPress is vulnerable to information exposure due to missing object-level authorization checks in versions up to, and including, 2.1.2. This is due to the plugin registering multiple REST API routes under `generateblocks/v1/meta/` that gate access with `current_user_can('edit_posts')`, which is granted to low-privileged roles such as Contributor. The handlers accept arbitrary entity IDs (user IDs, post IDs, etc.) and meta keys, returning any requested metadata with only a short blacklist of password-like keys for protection. There is no object-level authorization ensuring the caller is requesting only their own data, and there is no allowlist of safe keys. This makes it possible for authenticated attackers, with Contributor-level access and above, to exfiltrate personally identifiable information (PII) and other sensitive profile data of administrator accounts or any other users by directly querying user meta keys via the exposed endpoints via the `get_user_meta_rest` function. In typical WordPress + WooCommerce setups, this includes names, email, phone, and address fields that WooCommerce stores in user meta, enabling targeted phishing, account take
Product
GenerateBlocks
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update GenerateBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program: Missing AuthorizationCVE-2025-12362 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action.
Product
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program
Affected
up to 2.9.7
What to do
Affects up to 2.9.7. Update myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025Header Footer Script Adder – Insert Code in Header, Body & Footer: Stored Cross-Site ScriptingCVE-2025-12109 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the script adder present in posts in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Header Footer Script Adder – Insert Code in Header, Body & Footer
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Header Footer Script Adder – Insert Code in Header, Body & Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025WP to LinkedIn Auto Publish: Reflected Cross-Site ScriptingCVE-2025-12077 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP to LinkedIn Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP to LinkedIn Auto Publish
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update WP to LinkedIn Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025Social Media Auto Publish: Reflected Cross-Site ScriptingCVE-2025-12076 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage parameter in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Social Media Auto Publish
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update Social Media Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated: Server-Side Request ForgeryCVE-2025-11970 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the emplibot_call_webhook_with_error() and emplibot_process_zip_data() functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025Login Lockdown & Protection: IP Block BypassCVE-2025-11707 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts.
Product
Login Lockdown & Protection
Affected
up to 2.14
What to do
Affects up to 2.14. Update Login Lockdown & Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025Export WP Page to Static HTML & PDF: Sensitive Information ExposureCVE-2025-11693 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 through publicly exposed cookies.txt files containing authentication cookies. This makes it possible for unauthenticated attackers to cookies that may have been injected into the log file if the site administrator triggered a back-up using a specific user role like 'administrator.'
Product
Export WP Page to Static HTML & PDF
Affected
up to 4.3.4
What to do
Affects up to 4.3.4. Update Export WP Page to Static HTML & PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025Colibri Page Builder: Stored Cross-Site ScriptingCVE-2025-11376 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_loop' shortcode in all versions up to, and including, 1.0.335 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Colibri Page Builder
Affected
up to 1.0.335
What to do
Affects up to 1.0.335. Update Colibri Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025Mavix Education: Unauthorized modification of dataCVE-2025-11164 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mavix Education theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mavix_education_activate_plugin' AJAX action in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Creativ Demo Importer plugin.
Product
Mavix Education
Affected
up to 1.0
What to do
Affects up to 1.0. Update Mavix Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Dec 13, 2025URL Shortener Plugin For: SQL InjectionCVE-2025-10738 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection via the ‘analytic_id’ parameter in all versions up to, and including, 3.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
URL Shortener Plugin For
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update URL Shortener Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 13, 2025Filter & Grids: SQL InjectionCVE-2025-10289 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only works on MariaDB as the query results in a syntax error on MySQL.
Product
Filter & Grids
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025Brizy – Page Builder: Sensitive Information ExposureCVE-2025-0969 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including email addresses and hashed passwords of administrators.
Product
Brizy – Page Builder
Affected
up to 2.7.16
What to do
Affects up to 2.7.16. Update Brizy – Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Secure Copy Content Protection and Content Locking: Sensitive information exposureCVE-2025-14442 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers to access sensitive user data including emails, IP addresses, usernames, roles, and location data by directly accessing the exported CSV file.
Product
Secure Copy Content Protection and Content Locking
Affected
up to 4.9.2
What to do
Affects up to 4.9.2. Update Secure Copy Content Protection and Content Locking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Secure Copy Content Protection and Content Locking: Cross-Site Request ForgeryCVE-2025-14159 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.2. This is due to missing nonce validation on the 'ays_sccp_results_export_file' AJAX action. This makes it possible for unauthenticated attackers to export sensitive plugin data including email addresses, IP addresses, physical addresses, user IDs, and other user information via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The exported data is stored in a publicly accessible file, allowing attackers to receive the sensitive information even though they are not authenticated.
Product
Secure Copy Content Protection and Content Locking
Affected
up to 4.9.2
What to do
Affects up to 4.9.2. Update Secure Copy Content Protection and Content Locking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Simple Bike Rental: Unauthorized access of dataCVE-2025-14065 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni' AJAX action in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve all booking records containing customers' personally identifiable information (PII), including names, email addresses, and phone numbers.
Product
Simple Bike Rental
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Simple Bike Rental to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025AI Feeds: Stored Cross-Site ScriptingCVE-2025-14030 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife_post_meta' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AI Feeds
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update AI Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Magical Posts Display: Stored Cross-Site ScriptingCVE-2025-12965 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion widget in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Magical Posts Display
Affected
up to 1.2.54
What to do
Affects up to 1.2.54. Update Magical Posts Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 12, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Information ExposureCVE-2025-12408 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft event locations that they should not have access to.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 7.2.2.2
What to do
Affects up to 7.2.2.2. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2025Events Manager – Calendar, Bookings, Tickets, and more!: Cross-Site Request ForgeryCVE-2025-12407 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2. This is due to missing or incorrect nonce validation on the 'location_delete' action. This makes it possible for unauthenticated attackers to delete locations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 7.2.2.2
What to do
Affects up to 7.2.2.2. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2025Bookit: Has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment optionsCVE-2025-12841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
Product
Bookit
Fixed in
2.5.1
What to do
Update Bookit to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Dec 12, 2025WooMulti: Does not validate a file parameterCVE-2025-12835 · WordPress plugins & themes · reported by WPScanHigh 7.3
The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber to delete arbitrary files on the server.
Product
WooMulti
Affected
up to 17
What to do
Affects up to 17. Update WooMulti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 12, 2025PDF for Contact Form 7 + Drag and Drop Template Builder: Unauthorized post duplicationCVE-2025-14074 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to, and including, 6.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to duplicate arbitrary posts, including password protected or private ones.
Product
PDF for Contact Form 7 + Drag and Drop Template Builder
Affected
up to 6.3.3
What to do
Affects up to 6.3.3. Update PDF for Contact Form 7 + Drag and Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025MailerLite – Signup forms (official): Stored Cross-Site ScriptingCVE-2025-13993 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' parameters in versions up to, and including, 1.7.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MailerLite – Signup forms (official)
Affected
up to 1.7.16
What to do
Affects up to 1.7.16. Update MailerLite – Signup forms (official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Icegram Express - Email Subscribers, Newsletters and Marketing Automation: Missing AuthorizationCVE-2025-12348 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `run_action_scheduler_task` function. This makes it possible for unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage.
Product
Icegram Express - Email Subscribers, Newsletters and Marketing Automation
Affected
up to 5.9.10
What to do
Affects up to 5.9.10. Update Icegram Express - Email Subscribers, Newsletters and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Simple CSV Table: Directory TraversalCVE-2025-12960 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the `href` parameter in the `[csv]` shortcode. This is due to insufficient path validation before concatenating user-supplied input to a base directory path. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
Product
Simple CSV Table
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Simple CSV Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025BSK PDF Manager: Stored Cross-Site ScriptingCVE-2025-4970 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
BSK PDF Manager
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update BSK PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 12, 2025FunnelKit - Funnel Builder for WooCommerce Checkout: Time-based blind SQL InjectionCVE-2025-14169 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
FunnelKit - Funnel Builder for WooCommerce Checkout
Affected
up to 3.13.1.5
What to do
Affects up to 3.13.1.5. Update FunnelKit - Funnel Builder for WooCommerce Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025VikRentItems Flexible Rental Management System: Reflected Cross-Site ScriptingCVE-2025-14049 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
VikRentItems Flexible Rental Management System
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update VikRentItems Flexible Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Image Gallery – Photo Grid & Video Gallery: Path TraversalCVE-2025-13891 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.
Product
Image Gallery – Photo Grid & Video Gallery
Affected
up to 2.13.3
What to do
Affects up to 2.13.3. Update Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Mailgun Subscriptions: Stored Cross-Site ScriptingCVE-2025-11876 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mailgun Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mailgun_subscription_form' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mailgun Subscriptions
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Mailgun Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 12, 2025WP Fastest Cache Premium: Server-Side Request ForgeryCVE-2025-10583 · WordPress plugins & themes · reported by WordfenceLow 3.5
The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 via the 'get_server_time_ajax_request' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The free version is not affected.
Product
WP Fastest Cache Premium
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update WP Fastest Cache Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org research.cleantalk.org
Dec 12, 2025Ultra Addons for Contact Form 7: Unauthorized access of dataCVE-2025-14356 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_generated_pdf' function in all versions up to, and including, 3.5.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate and get form submission PDF, when the "PDF Generator" and the "Database" addons are enabled (disabled by default).
Product
Ultra Addons for Contact Form 7
Affected
up to 3.5.33
What to do
Affects up to 3.5.33. Update Ultra Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025WPNakama: Time-based SQL InjectionCVE-2025-14068 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions up to, and including, 0.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPNakama
Affected
up to 0.6.3
What to do
Affects up to 0.6.3. Update WPNakama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org plugins.trac.wordpress.org
Dec 12, 2025Guest Support: User Email DisclosureCVE-2025-13660 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a public AJAX endpoint that allows anyone to search for and retrieve user email addresses without any authentication or capability checks. This makes it possible for unauthenticated attackers to enumerate user accounts and extract email addresses via the guest_support_handler=ajax endpoint with the request=get_users parameter.
Product
Guest Support
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Guest Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Hippoo Mobile App for WooCommerce: Arbitrary file writeCVE-2025-12655 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and including, 1.7.1. This is due to the REST API endpoint `/wp-json/hippoo/v1/wc/token/save_callback/{token_id}` being registered with `permission_callback => '__return_true'`, which allows unauthenticated access. This makes it possible for unauthenticated attackers to write arbitrary JSON content to the server's publicly accessible upload directory via the vulnerable endpoint.
Product
Hippoo Mobile App for WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Fancy Product Designer: Stored Cross-Site ScriptingCVE-2025-12570 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping in the data-to-image.php and pdf-to-image.php files. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Fancy Product Designer
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Dec 12, 2025Construction Light: Does not have authorisation and CSRFCVE-2025-10684 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
Product
Construction Light
Fixed in
1.6.8
What to do
Update Construction Light to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com
Dec 11, 2025WP Job Portal: Stored Cross-Site ScriptingCVE-2025-14467 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin explicitly whitelisting the `<script>` tag in its `WPJOBPORTAL_ALLOWED_TAGS` configuration and using insufficient input sanitization when saving job descriptions. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts into job description fields via the job creation/editing interface. These scripts will execute whenever a user accesses an injected page, enabling session hijacking, credential theft, and other malicious activities.This only impacts multi-site installations, or those with unfiltered_html disabled.
Product
WP Job Portal
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Wpik WordPress Basic Ajax Form: Stored Cross-Site ScriptingCVE-2025-14393 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wpik WordPress Basic Ajax Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dname' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wpik WordPress Basic Ajax Form
Affected
up to 1.0
What to do
Affects up to 1.0. Update Wpik WordPress Basic Ajax Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org developer.wordpress.org
Dec 11, 2025Simple Theme Changer: Unauthorized modification of dataCVE-2025-14392 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions actions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings.
Product
Simple Theme Changer
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple Theme Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2025Simple Theme Changer: Cross-Site Request ForgeryCVE-2025-14391 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Simple Theme Changer
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple Theme Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2025Resource Library for Logged In Users: Cross-Site Request ForgeryCVE-2025-14354 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to perform various unauthorized actions including creating, editing, and deleting resources and categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Resource Library for Logged In Users
Affected
up to 1.5
What to do
Affects up to 1.5. Update Resource Library for Logged In Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Multi Uploader for Gravity Forms: Arbitrary file deletionCVE-2025-14344 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
Product
Multi Uploader for Gravity Forms
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Multi Uploader for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Vimeo SimpleGallery: Missing AuthorizationCVE-2025-14170 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 0.2. This is due to missing authorization checks on the `vimeogallery_admin` function hooked to `admin_menu`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings via the `action` parameter.
Product
Vimeo SimpleGallery
Affected
up to 0.2
What to do
Affects up to 0.2. Update Vimeo SimpleGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025WPMasterToolKit: PHP Code InjectionCVE-2025-14166 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing Author-level users to create and execute arbitrary PHP code through the Code Snippets feature without proper capability checks. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server, leading to remote code execution, privilege escalation, and complete site compromise.
Product
WPMasterToolKit
Affected
up to 2.13.0
What to do
Affects up to 2.13.0. Update WPMasterToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Kirim.Email WooCommerce Integration: Cross-Site Request ForgeryCVE-2025-14165 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is due to missing nonce validation on the plugin's settings page. This makes it possible for unauthenticated attackers to modify the plugin's API credentials and integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Kirim.Email WooCommerce Integration
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Kirim.Email WooCommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.