Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,251 results · page 280 of 826
Oct 22, 2025Emails Catch All: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-60041 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.This issue affects Emails Catch All: from n/a through <= 3.5.3.
- Product
- Emails Catch All
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Emails Catch All to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Noisa: Deserialization of Untrusted DataCVE-2025-60039 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.
- Product
- Noisa
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Noisa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Colibri Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59593 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.
- Product
- Colibri Page Builder
- Fixed in
- 1.0.334
- What to do
- Update Colibri Page Builder to 1.0.334 or newer.
Oct 22, 2025Goodlayers Core: Incorrect Privilege AssignmentCVE-2025-59580 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in GoodLayers Goodlayers Core goodlayers-core allows Privilege Escalation.This issue affects Goodlayers Core: from n/a through < 2.1.7.
- Product
- Goodlayers Core
- What to do
- Update Goodlayers Core to the newest version.
Oct 22, 2025Simple Job Board: Insertion of Sensitive Information Into Sent DataCVE-2025-59579 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in PressTigers Simple Job Board simple-job-board allows Retrieve Embedded Sensitive Data.This issue affects Simple Job Board: from n/a through <= 2.13.7.
- Product
- Simple Job Board
- Affected
- up to 2.13.7
- What to do
- Affects up to 2.13.7. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025ShopMagic: Insertion of Sensitive Information Into Sent DataCVE-2025-59578 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Insertion of Sensitive Information Into Sent Data vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through <= 4.5.6.
- Product
- ShopMagic
- Affected
- up to 4.5.6
- What to do
- Affects up to 4.5.6. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MasterStudy LMS: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59575 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.20
- What to do
- Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WorkScout-Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through < 1.7.06.
- Product
- WorkScout-Core
- What to do
- Update WorkScout-Core to the newest version.
Oct 22, 2025Workreap (theme's plugin): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-59566 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.5.
- Product
- Workreap (theme's plugin)
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Workreap (theme's plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025EduMall: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59564 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through < 4.4.5.
- Product
- EduMall
- Fixed in
- 4.4.5
- What to do
- Update EduMall to 4.4.5 or newer.
Oct 22, 2025Billey: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59558 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through < 2.1.6.
- Product
- Billey
- Fixed in
- 2.1.6
- What to do
- Update Billey to 2.1.6 or newer.
Oct 22, 2025Learts Addons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59557 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injection.This issue affects Learts Addons: from n/a through < 1.7.5.
- Product
- Learts Addons
- What to do
- Update Learts Addons to the newest version.
Oct 22, 2025Medizin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59555 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a through < 1.9.7.
- Product
- Medizin
- Fixed in
- 1.9.7
- What to do
- Update Medizin to 1.9.7 or newer.
Oct 22, 2025Xcare: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59550 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Xcare xcare allows PHP Local File Inclusion.This issue affects Xcare: from n/a through < 6.5.
- Product
- Xcare
- What to do
- Update Xcare to the newest version.
Oct 22, 2025TF Woo Product Grid Addon For Elementor: Deserialization of Untrusted DataCVE-2025-59007 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themesflat TF Woo Product Grid Addon For Elementor tf-woo-product-grid allows Object Injection.This issue affects TF Woo Product Grid Addon For Elementor: from n/a through <= 1.0.1.
- Product
- TF Woo Product Grid Addon For Elementor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update TF Woo Product Grid Addon For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Easy Woocommerce Customizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59006 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS.This issue affects Easy Woocommerce Customizer: from n/a through <= 1.0.2.
- Product
- Easy Woocommerce Customizer
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Easy Woocommerce Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WC Return products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pco_58 WC Return products wc-return-product allows Reflected XSS.This issue affects WC Return products: from n/a through <= 1.5.
- Product
- WC Return products
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WC Return products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Doctreat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58971 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmentoTech Doctreat doctreat allows Reflected XSS.This issue affects Doctreat: from n/a through <= 1.6.7.
- Product
- Doctreat
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Doctreat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Doctreat: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-58970 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through <= 1.6.7.
- Product
- Doctreat
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Doctreat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Businext: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58967 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Businext businext allows PHP Local File Inclusion.This issue affects Businext: from n/a through < 2.4.4.
- Product
- Businext
- Fixed in
- 2.4.4
- What to do
- Update Businext to 2.4.4 or newer.
Oct 22, 2025NEX-Forms LITE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58966 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms LITE nex-forms-lite allows Reflected XSS.This issue affects NEX-Forms LITE: from n/a through < 8.2.
- Product
- NEX-Forms LITE
- What to do
- Update NEX-Forms LITE to the newest version.
Oct 22, 2025Medcity: Unrestricted Upload of File with Dangerous TypeCVE-2025-58963 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Shell to a Web Server.This issue affects Medcity: from n/a through < 1.1.9.
- Product
- Medcity
- What to do
- Update Medcity to the newest version.
Oct 22, 2025CF7 Auto Responder Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58961 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav CF7 Auto Responder Addon CF7-autoresponder-addon allows DOM-Based XSS.This issue affects CF7 Auto Responder Addon: from n/a through <= 2.4.
- Product
- CF7 Auto Responder Addon
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update CF7 Auto Responder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Taskbot: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-58959 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Taskbot taskbot allows Path Traversal.This issue affects Taskbot: from n/a through <= 6.4.
- Product
- Taskbot
- Affected
- up to 6.4
- What to do
- Affects up to 6.4. Update Taskbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025SmilePure: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58958 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove SmilePure smilepure allows PHP Local File Inclusion.This issue affects SmilePure: from n/a through < 1.8.5.
- Product
- SmilePure
- Fixed in
- 1.8.5
- What to do
- Update SmilePure to 1.8.5 or newer.
Oct 22, 2025Karzo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58955 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Karzo karzo allows PHP Local File Inclusion.This issue affects Karzo: from n/a through < 2.6.
- Product
- Karzo
- What to do
- Update Karzo to the newest version.
Oct 22, 2025WP Tactical Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58921 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arevico WP Tactical Popup wp-tactical-popup allows Reflected XSS.This issue affects WP Tactical Popup: from n/a through <= 1.1.
- Product
- WP Tactical Popup
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Tactical Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Author: Munzir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58916 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munzir Author: Munzir myshouts-shoutbox allows Reflected XSS.This issue affects Author: Munzir: from n/a through <= 0.9.
- Product
- Author: Munzir
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Author: Munzir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Simple User Registration: Incorrect Privilege AssignmentCVE-2025-53428 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Registration: from n/a through <= 6.8.
- Product
- Simple User Registration
- Affected
- up to 6.8
- What to do
- Affects up to 6.8. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025SEO Pyramid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53427 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chibueze Okechukwu SEO Pyramid seo-pyramid allows Reflected XSS.This issue affects SEO Pyramid: from n/a through <= 1.9.8.
- Product
- SEO Pyramid
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update SEO Pyramid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Likert Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Likert Survey Master likert-survey-master allows Reflected XSS.This issue affects Likert Survey Master: from n/a through <= 0.8.0.1.
- Product
- Likert Survey Master
- Affected
- up to 0.8.0.1
- What to do
- Affects up to 0.8.0.1. Update Likert Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Dokan: Incorrect Privilege AssignmentCVE-2025-53425 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in Dokan, Inc. Dokan dokan-lite allows Privilege Escalation.This issue affects Dokan: from n/a through <= 4.1.3.
- Product
- Dokan
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Orders & Customers Exporter: Missing AuthorizationCVE-2025-53424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.
- Product
- WooCommerce Orders & Customers Exporter
- Affected
- up to 5.4
- What to do
- Affects up to 5.4. Update WooCommerce Orders & Customers Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Triss: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53423 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Triss triss allows Reflected XSS.This issue affects Triss: from n/a through <= 2.6.
- Product
- Triss
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Triss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WhatsApp Chat for WordPress and WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53422 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeWarriors WhatsApp Chat for WordPress and WooCommerce tw-whatsapp-chat-rotator allows Reflected XSS.This issue affects WhatsApp Chat for WordPress and WooCommerce: from n/a through <= 1.2.1.
- Product
- WhatsApp Chat for WordPress and WooCommerce
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update WhatsApp Chat for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Accordion: Missing AuthorizationCVE-2025-53421 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.
- Product
- Accordion
- Affected
- up to 2.3.14
- What to do
- Affects up to 2.3.14. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPLMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53420 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8.
- Product
- WPLMS
- Affected
- up to 1.9.9.8
- What to do
- Affects up to 1.9.9.8. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Grid Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Grid Plus grid-plus allows Reflected XSS.This issue affects Grid Plus: from n/a through <= 3.3.
- Product
- Grid Plus
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Grid Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Fidelo Snippet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fidelo Software GmbH Fidelo Snippet thebing-snippet allows Reflected XSS.This issue affects Fidelo Snippet: from n/a through <= 1.12.
- Product
- Fidelo Snippet
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Fidelo Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Calendar Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53350 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjunk Calendar Plus calendar-plus allows Reflected XSS.This issue affects Calendar Plus: from n/a through <= 1.2.4.
- Product
- Calendar Plus
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Calendar Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Woocommerce Envato Affiliates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53297 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Envato Affiliates wooenvato allows Reflected XSS.This issue affects Woocommerce Envato Affiliates: from n/a through <= 1.2.1.
- Product
- Woocommerce Envato Affiliates
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Woocommerce Envato Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Toast Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Toast Mobile Menu toast-responsive-menu allows Stored XSS.This issue affects Toast Mobile Menu: from n/a through <= 1.0.8.
- Product
- Toast Mobile Menu
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Toast Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025UDesign Core: Missing AuthorizationCVE-2025-53236 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in AndonDesign UDesign Core u-design-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UDesign Core: from n/a through <= 4.14.0.
- Product
- UDesign Core
- Affected
- up to 4.14.0
- What to do
- Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025UDesign Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53234 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign Core u-design-core allows Reflected XSS.This issue affects UDesign Core: from n/a through <= 4.14.0.
- Product
- UDesign Core
- Affected
- up to 4.14.0
- What to do
- Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP Gmail SMTP: Insertion of Sensitive Information Into Sent DataCVE-2025-53232 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Insertion of Sensitive Information Into Sent Data vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Retrieve Embedded Sensitive Data.This issue affects WP Gmail SMTP: from n/a through <= 1.0.7.
- Product
- WP Gmail SMTP
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update WP Gmail SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025RockON DJ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53229 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav RockON DJ rockon allows Reflected XSS.This issue affects RockON DJ: from n/a through <= 3.3.
- Product
- RockON DJ
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update RockON DJ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025AppExperts: Insertion of Sensitive Information Into Sent DataCVE-2025-53218 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through <= 1.4.5.
- Product
- AppExperts
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update AppExperts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Hello Followers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appscreo Hello Followers hellofollowers allows Reflected XSS.This issue affects Hello Followers: from n/a through <= 2.5.
- Product
- Hello Followers
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Hello Followers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Nifty Backups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NickDuncan Nifty Backups nifty-backups allows Reflected XSS.This issue affects Nifty Backups: from n/a through <= 1.08.
- Product
- Nifty Backups
- Affected
- up to 1.08
- What to do
- Affects up to 1.08. Update Nifty Backups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MultiSite Clone Duplicator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Globalis MultiSite Clone Duplicator multisite-clone-duplicator allows Reflected XSS.This issue affects MultiSite Clone Duplicator: from n/a through <= 1.5.3.
- Product
- MultiSite Clone Duplicator
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update MultiSite Clone Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.