Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

4,657 results · page 28 of 94

Jun 25, 2025Homerunner: Cross-Site Request ForgeryCVE-2025-5932 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to missing or incorrect nonce validation on the main_settings() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Homerunner
Affected
up to 1.0.30
What to do
Affects up to 1.0.30. Update Homerunner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2025Real Estate Manager: Cross-Site Request Forgery (CSRF)CVE-2025-52825 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Privilege Escalation.This issue affects Real Estate Manager: from n/a through <= 7.3.
Product
Real Estate Manager
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WP Front User Submit / Front Editor: Cross-Site Request Forgery (CSRF)CVE-2025-52795 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Cross Site Request Forgery.This issue affects WP Front User Submit / Front Editor: from n/a through <= 5.0.6.
Product
WP Front User Submit / Front Editor
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update WP Front User Submit / Front Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Creative Contact Form: Cross-Site Request Forgery (CSRF)CVE-2025-52794 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through <= 1.0.0.
Product
Creative Contact Form
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Creative Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Esselink.nu Settings: Cross-Site Request Forgery (CSRF)CVE-2025-52793 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Esselink.nu Settings esselinknu-settings allows Reflected XSS.This issue affects Esselink.nu Settings: from n/a through <= 4.5.
Product
Esselink.nu Settings
Affected
up to 4.5
What to do
Affects up to 4.5. Update Esselink.nu Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WP User Stylesheet Switcher: Cross-Site Request Forgery (CSRF)CVE-2025-52792 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in vgstef WP User Stylesheet Switcher wp-user-stylesheet-switcher allows Stored XSS.This issue affects WP User Stylesheet Switcher: from n/a through <= v2.2.0.
Product
WP User Stylesheet Switcher
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update WP User Stylesheet Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Knowledge Base – Knowledge Base Maker: Cross-Site Request Forgery (CSRF)CVE-2025-52791 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in devfelixmoira Knowledge Base – Knowledge Base Maker knowledge-base-maker allows Stored XSS.This issue affects Knowledge Base – Knowledge Base Maker: from n/a through <= 1.1.8.
Product
Knowledge Base – Knowledge Base Maker
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Knowledge Base – Knowledge Base Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WP-DownloadCounter: Cross-Site Request Forgery (CSRF)CVE-2025-52790 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in r-win WP-DownloadCounter wp-downloadcounter allows Stored XSS.This issue affects WP-DownloadCounter: from n/a through <= 1.01.
Product
WP-DownloadCounter
Affected
up to 1.01
What to do
Affects up to 1.01. Update WP-DownloadCounter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Lewe ChordPress: Cross-Site Request Forgery (CSRF)CVE-2025-52789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in George Lewe Lewe ChordPress chordpress allows Stored XSS.This issue affects Lewe ChordPress: from n/a through <= 4.0.1.
Product
Lewe ChordPress
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Lewe ChordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Bluff Post: Cross-Site Request Forgery (CSRF)CVE-2025-52784 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post bluff-post allows Stored XSS.This issue affects Bluff Post: from n/a through <= 1.1.1.
Product
Bluff Post
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Bluff Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Change Cart button Colors WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-52783 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in themelocation Change Cart button Colors WooCommerce wc-style allows Stored XSS.This issue affects Change Cart button Colors WooCommerce: from n/a through <= 1.0.
Product
Change Cart button Colors WooCommerce
Affected
up to 1.0
What to do
Affects up to 1.0. Update Change Cart button Colors WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025TinyNav: Cross-Site Request Forgery (CSRF)CVE-2025-52781 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav tinynav allows Stored XSS.This issue affects TinyNav: from n/a through <= 1.4.
Product
TinyNav
Affected
up to 1.4
What to do
Affects up to 1.4. Update TinyNav to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Logo Manager For Samandehi: Cross-Site Request Forgery (CSRF)CVE-2025-52780 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mohammad Parsa Logo Manager For Samandehi samandehi-logo-manager allows Stored XSS.This issue affects Logo Manager For Samandehi: from n/a through <= 0.5.
Product
Logo Manager For Samandehi
Affected
up to 0.5
What to do
Affects up to 0.5. Update Logo Manager For Samandehi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Virtual Moderator: Cross-Site Request Forgery (CSRF)CVE-2025-52772 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Adnan Haque (a11n) Virtual Moderator allows Cross-Site Scripting (XSS). This issue affects Virtual Moderator: from n/a through 1.4.
Product
Virtual Moderator
Affected
up to 1.4
What to do
Affects up to 1.4. Update Virtual Moderator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Post and Page Builder by BoldGrid: Server-Side Request Forgery (SSRF)CVE-2025-52713 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Server Side Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
Product
Post and Page Builder by BoldGrid
Affected
up to 1.27.8
What to do
Affects up to 1.27.8. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Post and Page Builder by BoldGrid: Cross-Site Request Forgery (CSRF)CVE-2025-52711 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
Product
Post and Page Builder by BoldGrid
Affected
up to 1.27.8
What to do
Affects up to 1.27.8. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Real Estate Manager: Cross-Site Request Forgery (CSRF)CVE-2025-50044 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Cross Site Request Forgery.This issue affects Real Estate Manager: from n/a through <= 7.3.
Product
Real Estate Manager
Affected
up to 7.3
What to do
Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Mailing Group Listserv: Cross-Site Request Forgery (CSRF)CVE-2025-50036 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows Cross Site Request Forgery.This issue affects Mailing Group Listserv: from n/a through <= 3.0.5.
Product
Mailing Group Listserv
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Mailing Group Listserv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Auto Upload Images: Server-Side Request Forgery (SSRF)CVE-2025-49985 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Ali Irani Auto Upload Images auto-upload-images allows Server Side Request Forgery.This issue affects Auto Upload Images: from n/a through <= 3.3.2.
Product
Auto Upload Images
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Auto Upload Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025PowerPress Podcasting: Server-Side Request Forgery (SSRF)CVE-2025-49984 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress Podcasting: from n/a through <= 11.13.11.
Product
PowerPress Podcasting
Affected
up to 11.13.11
What to do
Affects up to 11.13.11. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WPThumb: Server-Side Request Forgery (SSRF)CVE-2025-49983 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Joe Hoyle WPThumb wp-thumb allows Server Side Request Forgery.This issue affects WPThumb: from n/a through <= 0.10.
Product
WPThumb
Affected
up to 0.10
What to do
Affects up to 0.10. Update WPThumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WP Inventory Manager: Cross-Site Request Forgery (CSRF)CVE-2025-49977 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through <= 2.3.4.
Product
WP Inventory Manager
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update WP Inventory Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025JobWP: Cross-Site Request Forgery (CSRF)CVE-2025-49975 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.4.0.
Product
JobWP
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025TM Replace Howdy: Cross-Site Request Forgery (CSRF)CVE-2025-49972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Wood TM Replace Howdy tm-replace-howdy allows Cross Site Request Forgery.This issue affects TM Replace Howdy: from n/a through <= 1.4.2.
Product
TM Replace Howdy
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update TM Replace Howdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025XML Travel Portal Widget: Cross-Site Request Forgery (CSRF)CVE-2025-49968 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oganro XML Travel Portal Widget oganro-reservation-widget allows Cross Site Request Forgery.This issue affects XML Travel Portal Widget: from n/a through <= 2.0.
Product
XML Travel Portal Widget
Affected
up to 2.0
What to do
Affects up to 2.0. Update XML Travel Portal Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Live Sports Streamthunder: Cross-Site Request Forgery (CSRF)CVE-2025-49967 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issue affects Live Sports Streamthunder: from n/a through <= 2.1.
Product
Live Sports Streamthunder
Affected
up to 2.1
What to do
Affects up to 2.1. Update Live Sports Streamthunder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Oganro Travel Portal Search Widget for HotelBeds APITUDE API: Cross-Site Request Forgery (CSRF)CVE-2025-49966 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through <= 1.0.
Product
Oganro Travel Portal Search Widget for HotelBeds APITUDE API
Affected
up to 1.0
What to do
Affects up to 1.0. Update Oganro Travel Portal Search Widget for HotelBeds APITUDE API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025PixelBeds Channel Manager and Hotel Booking Engine: Cross-Site Request Forgery (CSRF)CVE-2025-49965 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cross Site Request Forgery.This issue affects PixelBeds Channel Manager and Hotel Booking Engine: from n/a through <= 1.0.
Product
PixelBeds Channel Manager and Hotel Booking Engine
Affected
up to 1.0
What to do
Affects up to 1.0. Update PixelBeds Channel Manager and Hotel Booking Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025ClipLink: Cross-Site Request Forgery (CSRF)CVE-2025-49964 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in indgeek ClipLink cliplink allows Cross Site Request Forgery.This issue affects ClipLink: from n/a through <= 1.1.
Product
ClipLink
Affected
up to 1.1
What to do
Affects up to 1.1. Update ClipLink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025ProfileGrid: Server-Side Request Forgery (SSRF)CVE-2025-49877 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Server Side Request Forgery.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
Product
ProfileGrid
Affected
up to 5.9.5.2
What to do
Affects up to 5.9.5.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Advanced Settings: Cross-Site Request Forgery (CSRF)CVE-2025-49865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanced Settings: from n/a through <= 3.0.1.
Product
Advanced Settings
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Advanced Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Responsive Plus: Cross-Site Request Forgery (CSRF)CVE-2025-49856 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsive Plus: from n/a through <= 3.2.2.
Product
Responsive Plus
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Responsive Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025YITH PayPal Express Checkout for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48111 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.
Product
YITH PayPal Express Checkout for WooCommerce
Affected
up to 1.49.0
What to do
Affects up to 1.49.0. Update YITH PayPal Express Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 14, 2025WP URL Shortener: Cross-Site Request ForgeryCVE-2025-6064 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the 'url_shortener_settings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP URL Shortener
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025XiSearch bar: Cross-Site Request ForgeryCVE-2025-6063 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The XiSearch bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6. This is due to missing or incorrect nonce validation on the 'xisearch-key-config' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
XiSearch bar
Affected
up to 2.6
What to do
Affects up to 2.6. Update XiSearch bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025Yougler Blogger Profile Page: Cross-Site Request ForgeryCVE-2025-6062 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Yougler Blogger Profile Page
Affected
up to v1.01
What to do
Affects up to v1.01. Update Yougler Blogger Profile Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025Zen Sticky Social: Cross-Site Request ForgeryCVE-2025-6055 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Zen Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Zen Sticky Social
Affected
up to 0.3
What to do
Affects up to 0.3. Update Zen Sticky Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025Easy Flashcards: Cross-Site Request ForgeryCVE-2025-6040 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'ef_settings_submenu' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Flashcards
Affected
up to 0.1
What to do
Affects up to 0.1. Update Easy Flashcards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 14, 2025AI Image Lab – Free AI Image Generator: Cross-Site Request ForgeryCVE-2025-4592 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Image Lab – Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
AI Image Lab – Free AI Image Generator
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update AI Image Lab – Free AI Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 13, 2025Seraphinite Accelerator: Cross-Site Request ForgeryCVE-2025-6059 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Seraphinite Accelerator
Affected
up to 2.27.21
What to do
Affects up to 2.27.21. Update Seraphinite Accelerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2025Digital Marketing and Agency Templates Addons for Elementor: Cross-Site Request ForgeryCVE-2025-5938 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the import_templates() function. This makes it possible for unauthenticated attackers to trigger an import via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Digital Marketing and Agency Templates Addons for Elementor
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Digital Marketing and Agency Templates Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025WP2HTML: Cross-Site Request ForgeryCVE-2025-5930 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP2HTML
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP2HTML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025WP Sliding Login/Dashboard Panel: Cross-Site Request ForgeryCVE-2025-5928 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Sliding Login/Dashboard Panel
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update WP Sliding Login/Dashboard Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025Link Shield: Cross-Site Request ForgeryCVE-2025-5926 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the link_shield_menu_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Link Shield
Affected
up to 0.5.4
What to do
Affects up to 0.5.4. Update Link Shield to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2025Civi Framework: Cross-Site Request Forgery (CSRF)CVE-2025-49511 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in uxper Civi Framework civi-framework allows Cross Site Request Forgery.This issue affects Civi Framework: from n/a through <= 2.1.6.
Product
Civi Framework
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Civi Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 10, 2025Min Max Step Quantity Limits Manager for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-49510 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce product-quantity-for-woocommerce allows Cross Site Request Forgery.This issue affects Min Max Step Quantity Limits Manager for WooCommerce: from n/a through <= 5.1.0.
Product
Min Max Step Quantity Limits Manager for WooCommerce
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Min Max Step Quantity Limits Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 10, 2025Bunny’s Print CSS: Cross-Site Request ForgeryCVE-2025-5925 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bunny’s Print CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.95. This is due to missing or incorrect nonce validation on the pcss_options_subpanel() function. This makes it possible for unauthenticated attackers to update settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Bunny’s Print CSS
Affected
up to 0.95
What to do
Affects up to 0.95. Update Bunny’s Print CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2025BP Profile as Homepage: Cross-Site Request Forgery (CSRF)CVE-2025-49453 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jatinder Pal Singh BP Profile as Homepage bp-profile-as-homepage allows Stored XSS.This issue affects BP Profile as Homepage: from n/a through <= 1.1.
Product
BP Profile as Homepage
Affected
up to 1.1
What to do
Affects up to 1.1. Update BP Profile as Homepage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Interactive Regional Map of Africa: Cross-Site Request Forgery (CSRF)CVE-2025-49449 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive Regional Map of Africa interactive-map-of-africa allows Cross Site Request Forgery.This issue affects Interactive Regional Map of Africa: from n/a through <= 1.0.
Product
Interactive Regional Map of Africa
Affected
up to 1.0
What to do
Affects up to 1.0. Update Interactive Regional Map of Africa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Admin Notes: Cross-Site Request Forgery (CSRF)CVE-2025-49446 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a through <= 1.1.
Product
Admin Notes
Affected
up to 1.1
What to do
Affects up to 1.1. Update Admin Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.