Vulnerability database

4,657 results · page 29 of 94

• Jun 6, 2025Interactive UK Regional Map: Cross-Site Request Forgery (CSRF)CVE-2025-49445 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive UK Regional Map interactive-uk-regional-map allows Cross Site Request Forgery.This issue affects Interactive UK Regional Map: from n/a through <= 2.0.

  Product

  Interactive UK Regional Map

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Interactive UK Regional Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Security Master: Cross-Site Request Forgery (CSRF)CVE-2025-49440 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Vuong Nguyen WP Security Master wp-security-master allows Cross Site Request Forgery.This issue affects WP Security Master: from n/a through <= 1.0.2.

  Product

  WP Security Master

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Security Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Atelier Create CV: Cross-Site Request Forgery (CSRF)CVE-2025-49439 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in mariusz88atelierweb Atelier Create CV atelier-create-cv allows Cross Site Request Forgery.This issue affects Atelier Create CV: from n/a through <= 1.1.5.

  Product

  Atelier Create CV

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Atelier Create CV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Wp Easy Allopass: Cross-Site Request Forgery (CSRF)CVE-2025-49435 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Hasina77 Wp Easy Allopass wordpress-easy-allopass allows Cross Site Request Forgery.This issue affects Wp Easy Allopass: from n/a through <= 4.1.1.

  Product

  Wp Easy Allopass

  Affected

  up to 4.1.1

  What to do

  Affects up to 4.1.1. Update Wp Easy Allopass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Konami Easter Egg: Cross-Site Request Forgery (CSRF)CVE-2025-49425 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft Konami Easter Egg konami-easter-egg allows Stored XSS.This issue affects Konami Easter Egg: from n/a through <= v0.4.

  Product

  Konami Easter Egg

  Affected

  up to 0.4

  What to do

  Affects up to 0.4. Update Konami Easter Egg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Time Slots Booking Form: Cross-Site Request Forgery (CSRF)CVE-2025-49332 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.30.

  Product

  WP Time Slots Booking Form

  Affected

  up to 1.2.30

  What to do

  Affects up to 1.2.30. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Page Loading: Cross-Site Request Forgery (CSRF)CVE-2025-49317 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in NTC WP Page Loading wp-page-loading allows Cross Site Request Forgery.This issue affects WP Page Loading: from n/a through <= 1.0.6.

  Product

  WP Page Loading

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update WP Page Loading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Calculated Fields Form: Cross-Site Request Forgery (CSRF)CVE-2025-49291 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.

  Product

  Calculated Fields Form

  Affected

  up to 5.3.58

  What to do

  Affects up to 5.3.58. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Table Builder: Cross-Site Request Forgery (CSRF)CVE-2025-49286 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through <= 2.0.6.

  Product

  WP Table Builder

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update WP Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Cross-Site Request Forgery (CSRF)CVE-2025-49285 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 3.8.0.

  Product

  WP Cookie Notice for GDPR, CCPA & ePrivacy Consent

  Affected

  up to 3.8.0

  What to do

  Affects up to 3.8.0. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Maintenance Mode & Site Under Construction: Cross-Site Request Forgery (CSRF)CVE-2025-49284 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through <= 4.3.

  Product

  WP Maintenance Mode & Site Under Construction

  Affected

  up to 4.3

  What to do

  Affects up to 4.3. Update WP Maintenance Mode & Site Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: Cross-Site Request Forgery (CSRF)CVE-2025-49283 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant gdpr-compliant-recaptcha-for-all-forms allows Cross Site Request Forgery.This issue affects Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: from n/a through <= 4.1.1.

  Product

  Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant

  Affected

  up to 4.1.1

  What to do

  Affects up to 4.1.1. Update Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Tools: Cross-Site Request Forgery (CSRF)CVE-2025-49273 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through <= 5.24.

  Product

  WP Tools

  Affected

  up to 5.24

  What to do

  Affects up to 5.24. Update WP Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Market Exporter: Cross-Site Request Forgery (CSRF)CVE-2025-49269 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Anton Vanyukov Market Exporter market-exporter allows Cross Site Request Forgery.This issue affects Market Exporter: from n/a through <= 2.0.22.

  Product

  Market Exporter

  Affected

  up to 2.0.22

  What to do

  Affects up to 2.0.22. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Print Invoice & Delivery Notes for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-49239 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.5.0.

  Product

  Print Invoice & Delivery Notes for WooCommerce

  Affected

  up to 5.5.0

  What to do

  Affects up to 5.5.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Everest Backup: Cross-Site Request Forgery (CSRF)CVE-2025-49238 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Cross Site Request Forgery.This issue affects Everest Backup: from n/a through <= 2.3.3.

  Product

  Everest Backup

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025POEditor: Cross-Site Request Forgery (CSRF)CVE-2025-49237 · WordPress plugins & themes · reported by PatchstackHigh 7.4

  Cross-Site Request Forgery (CSRF) vulnerability in POEditor POEditor poeditor allows Path Traversal.This issue affects POEditor: from n/a through <= 0.9.10.

  Product

  POEditor

  Affected

  up to 0.9.10

  What to do

  Affects up to 0.9.10. Update POEditor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Car Repair Services: Server-Side Request Forgery (SSRF)CVE-2025-30997 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Car Repair Services car-repair-services allows Server Side Request Forgery.This issue affects Car Repair Services: from n/a through <= 5.0.

  Product

  Car Repair Services

  Affected

  up to 5.0

  What to do

  Affects up to 5.0. Update Car Repair Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Widgetize Pages Light: Cross-Site Request Forgery (CSRF)CVE-2025-30995 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.

  Product

  Widgetize Pages Light

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update Widgetize Pages Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025CubeWP: Cross-Site Request Forgery (CSRF)CVE-2025-30994 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Cross Site Request Forgery.This issue affects CubeWP: from n/a through <= 1.1.29.

  Product

  CubeWP

  Affected

  up to 1.1.29

  What to do

  Affects up to 1.1.29. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Elite Video Player: Cross-Site Request Forgery (CSRF)CVE-2025-30986 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Cross Site Request Forgery.This issue affects Elite Video Player: from n/a through <= 10.0.5.

  Product

  Elite Video Player

  Affected

  up to 10.0.5

  What to do

  Affects up to 10.0.5. Update Elite Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP-Recall: Cross-Site Request Forgery (CSRF)CVE-2025-30981 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14.

  Product

  WP-Recall

  Affected

  up to 16.26.14

  What to do

  Affects up to 16.26.14. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Simple Keyword to Link: Cross-Site Request Forgery (CSRF)CVE-2025-30980 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through <= 1.5.

  Product

  Simple Keyword to Link

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Simple Keyword to Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Nexa Blocks: Server-Side Request Forgery (SSRF)CVE-2025-30976 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks nexa-blocks allows Server Side Request Forgery.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

  Product

  Nexa Blocks

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Nexa Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Advanced Post List: Cross-Site Request Forgery (CSRF)CVE-2025-30968 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in jokerbr313 Advanced Post List advanced-post-list allows Cross Site Request Forgery.This issue affects Advanced Post List: from n/a through <= 0.5.6.2.

  Product

  Advanced Post List

  Affected

  up to 0.5.6.2

  What to do

  Affects up to 0.5.6.2. Update Advanced Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Booqable Rental: Cross-Site Request Forgery (CSRF)CVE-2025-30956 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Booqable Rental Software Booqable Rental booqable-rental-reservations allows Cross Site Request Forgery.This issue affects Booqable Rental: from n/a through <= 2.4.25.

  Product

  Booqable Rental

  Affected

  up to 2.4.25

  What to do

  Affects up to 2.4.25. Update Booqable Rental to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Layouts for Elementor: Cross-Site Request Forgery (CSRF)CVE-2025-30948 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Giraphix Creative Layouts for Elementor layouts-for-elementor allows Cross Site Request Forgery.This issue affects Layouts for Elementor: from n/a through <= 1.11.

  Product

  Layouts for Elementor

  Affected

  up to 1.11

  What to do

  Affects up to 1.11. Update Layouts for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Custom Bulk/Quick Edit: Cross-Site Request Forgery (CSRF)CVE-2025-30946 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Michael Cannon Custom Bulk/Quick Edit custom-bulkquick-edit allows Cross Site Request Forgery.This issue affects Custom Bulk/Quick Edit: from n/a through <= 1.6.10.

  Product

  Custom Bulk/Quick Edit

  Affected

  up to 1.6.10

  What to do

  Affects up to 1.6.10. Update Custom Bulk/Quick Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Global Translator: Cross-Site Request Forgery (CSRF)CVE-2025-30632 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in pozzad Global Translator global-translator allows Cross Site Request Forgery.This issue affects Global Translator: from n/a through <= 2.0.2.

  Product

  Global Translator

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Global Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Bitly URL Shortener: Cross-Site Request Forgery (CSRF)CVE-2025-30629 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Codehaveli Bitly URL Shortener codehaveli-bitly-url-shortener allows Cross Site Request Forgery.This issue affects Bitly URL Shortener: from n/a through <= 1.4.1.

  Product

  Bitly URL Shortener

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Bitly URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025SocialMark: Server-Side Request Forgery (SSRF)CVE-2025-29008 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in ShawonPro SocialMark socialmark allows Server Side Request Forgery.This issue affects SocialMark: from n/a through <= 2.0.7.

  Product

  SocialMark

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update SocialMark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025HR Management Lite: Cross-Site Request Forgery (CSRF)CVE-2025-29005 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Cross Site Request Forgery.This issue affects HR Management Lite: from n/a through <= 3.6.

  Product

  HR Management Lite

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update HR Management Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Epicwin: Cross-Site Request Forgery (CSRF)CVE-2025-28986 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin epicwin-subscribers allows SQL Injection.This issue affects Epicwin Plugin: from n/a through <= 1.5.

  Product

  Epicwin

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Epicwin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Subscription Renewal Reminders for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-28984 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in storepro Subscription Renewal Reminders for WooCommerce subscriptions-renewal-reminders allows Cross Site Request Forgery.This issue affects Subscription Renewal Reminders for WooCommerce: from n/a through <= 1.4.1.

  Product

  Subscription Renewal Reminders for WooCommerce

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Subscription Renewal Reminders for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Mail Options: Cross-Site Request Forgery (CSRF)CVE-2025-28981 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Soli WP Mail Options wp-mail-options allows Stored XSS.This issue affects WP Mail Options: from n/a through <= 0.2.3.

  Product

  WP Mail Options

  Affected

  up to 0.2.3

  What to do

  Affects up to 0.2.3. Update WP Mail Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Free WP Mail SMTP: Cross-Site Request Forgery (CSRF)CVE-2025-28974 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mail250 Free WP Mail SMTP free-wp-mail-smtp allows Stored XSS.This issue affects Free WP Mail SMTP: from n/a through <= 1.0.

  Product

  Free WP Mail SMTP

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Free WP Mail SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Recent Posts Slider Responsive: Cross-Site Request Forgery (CSRF)CVE-2025-28966 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affects Recent Posts Slider Responsive: from n/a through <= 1.0.1.

  Product

  Recent Posts Slider Responsive

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Recent Posts Slider Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Personal Favicon: Cross-Site Request Forgery (CSRF)CVE-2025-28964 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a through <= 2.0.

  Product

  Personal Favicon

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Personal Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Bg Orthodox Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-28958 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov Bg Orthodox Calendar bg-orthodox-calendar allows Stored XSS.This issue affects Bg Orthodox Calendar: from n/a through <= 0.13.10.

  Product

  Bg Orthodox Calendar

  Affected

  up to 0.13.10

  What to do

  Affects up to 0.13.10. Update Bg Orthodox Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Backwp: Cross-Site Request Forgery (CSRF)CVE-2025-28954 · WordPress plugins & themes · reported by PatchstackHigh 7.4

  Cross-Site Request Forgery (CSRF) vulnerability in wphobby Backwp backwp allows Path Traversal.This issue affects Backwp: from n/a through <= 2.0.2.

  Product

  Backwp

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Backwp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025CubePoints: Cross-Site Request Forgery (CSRF)CVE-2025-28952 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Lau CubePoints cubepoints allows Cross Site Request Forgery.This issue affects CubePoints: from n/a through <= 3.2.1.

  Product

  CubePoints

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update CubePoints to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Post Author: Cross-Site Request Forgery (CSRF)CVE-2025-28950 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through <= 1.1.1.

  Product

  Post Author

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Mediabay - WordPress Media Library Folders: Cross-Site Request Forgery (CSRF)CVE-2025-28948 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.

  Product

  Mediabay - WordPress Media Library Folders

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Quick Event Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-27360 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Cross Site Request Forgery.This issue affects Quick Event Calendar: from n/a through <= 1.4.9.

  Product

  Quick Event Calendar

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update Quick Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025WP Media File Type Manager: Cross-Site Request Forgery (CSRF)CVE-2025-27359 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Media File Type Manager wp-media-file-type-manager allows Cross Site Request Forgery.This issue affects WP Media File Type Manager: from n/a through <= 2.3.1.

  Product

  WP Media File Type Manager

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update WP Media File Type Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025FastBook: Cross-Site Request Forgery (CSRF)CVE-2025-26593 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Cross Site Request Forgery.This issue affects FastBook: from n/a through <= 1.1.

  Product

  FastBook

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update FastBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Pay with Contact Form 7: Cross-Site Request Forgery (CSRF)CVE-2025-24772 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.

  Product

  Pay with Contact Form 7

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Pay with Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Dynamic Pricing and Discount Rules: Cross-Site Request Forgery (CSRF)CVE-2025-49077 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeHigh Dynamic Pricing and Discount Rules discount-and-dynamic-pricing allows Cross Site Request Forgery.This issue affects Dynamic Pricing and Discount Rules: from n/a through <= 2.2.9.

  Product

  Dynamic Pricing and Discount Rules

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update Dynamic Pricing and Discount Rules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Real Time Validation for Gravity Forms: Cross-Site Request Forgery (CSRF)CVE-2025-48328 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.

  Product

  Real Time Validation for Gravity Forms

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Real Time Validation for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 6, 2025Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for: Cross-Site Request ForgeryCVE-2025-5019 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the hs_update_ai_chat_settings() function. This makes it possible for unauthenticated attackers to reconfigure the plugin’s AI/chat settings (including API keys) and to potentially redirect notifications or leak data to attacker-controlled endpoints via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.