Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

317 results · page 3 of 7

Nov 10, 2025Live Photos on: Stored Cross-Site ScriptingCVE-2025-12651 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user accesses an injected page.
Product
Live Photos on
Affected
up to 0.1
What to do
Affects up to 0.1. Update Live Photos on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 10, 2025Five9 Live Chat: Stored Cross-Site ScriptingCVE-2025-11829 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Five9 Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'toolbar' attribute of the [five9-chat] shortcode in all versions up to, and including, 1.1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Five9 Live Chat
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Five9 Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2025AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant: CSV InjectionCVE-2025-11576 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.6.5. This is due to insufficient sanitization in the 'newcodebyte_chatbot_export_messages' function. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Product
AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 11, 2025WordPress Live Webcam Widget & Shortcode: Stored Cross-Site ScriptingCVE-2025-10129 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Live Webcam Widget & Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Live Webcam Widget & Shortcode
Affected
up to 1.2
What to do
Affects up to 1.2. Update WordPress Live Webcam Widget & Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2025Casengo Live Chat Support: Cross-Site Request Forgery (CSRF)CVE-2025-58688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Casengo Casengo Live Chat Support the-casengo-chat-widget allows Stored XSS.This issue affects Casengo Live Chat Support: from n/a through <= 2.1.4.
Product
Casengo Live Chat Support
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Casengo Live Chat Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Deliver via Shipos for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-57914 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Matat Technologies Deliver via Shipos for WooCommerce wc-shipos-delivery allows Cross Site Request Forgery.This issue affects Deliver via Shipos for WooCommerce: from n/a through <= 3.0.2.
Product
Deliver via Shipos for WooCommerce
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Deliver via Shipos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Dialogity Free Live Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57912 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dialogity Dialogity Free Live Chat dialogity-website-chat allows Stored XSS.This issue affects Dialogity Free Live Chat: from n/a through <= 1.0.3.
Product
Dialogity Free Live Chat
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Dialogity Free Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025RumbleTalk Live Group Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58626 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Stored XSS.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.3.5.
Product
RumbleTalk Live Group Chat
Affected
up to 6.3.5
What to do
Affects up to 6.3.5. Update RumbleTalk Live Group Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-58599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.
Product
Order Delivery Date for WooCommerce
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Risk Free Cash On Delivery (COD) – WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48358 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommerce risk-free-cash-on-delivery-cod-woocommerce allows Stored XSS.This issue affects Risk Free Cash On Delivery (COD) – WooCommerce: from n/a through <= 1.0.4.
Product
Risk Free Cash On Delivery (COD) – WooCommerce
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Risk Free Cash On Delivery (COD) – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 24, 2025Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Unauthenticated login token generationCVE-2025-6441 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthenticated login token generation due to a missing capability check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versions up to, and including, 4.03.32. This makes it possible for unauthenticated attackers to generate login tokens for arbitrary WordPress users under certain circumstances, issuing authorization cookies which can lead to authentication bypass.
Product
Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Affected
up to 4.03.32
What to do
Affects up to 4.03.32. Update Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 18, 2025Live Stream Badger: Stored Cross-Site ScriptingCVE-2025-7655 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Live Stream Badger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livestream' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Live Stream Badger
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Live Stream Badger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jul 16, 2025Counter live visitors for WooCommerce: Arbitrary file deletionCVE-2025-7359 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitor_get_block function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server. NOTE: This particular vulnerability deletes all the files in a targeted arbitrary directory rather than a specified arbitrary file, which can lead to loss of data or a denial of service condition.
Product
Counter live visitors for WooCommerce
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Counter live visitors for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2025Order Delivery Date: Discloses arbitrary post title (suchCVE-2025-2942 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information
Product
Order Delivery Date
Fixed in
12.6.0
What to do
Update Order Delivery Date to 12.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2025Chatra Live Chat + ChatBot + Cart Saver: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24735 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chatra Chatra Live Chat + ChatBot + Cart Saver allows Stored XSS. This issue affects Chatra Live Chat + ChatBot + Cart Saver: from n/a through 1.0.11.
Product
Chatra Live Chat + ChatBot + Cart Saver
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Chatra Live Chat + ChatBot + Cart Saver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025WP YouTube Live: Cross-Site Request Forgery (CSRF)CVE-2025-53261 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through <= 1.10.0.
Product
WP YouTube Live
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update WP YouTube Live to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Live Sports Streamthunder: Cross-Site Request Forgery (CSRF)CVE-2025-49967 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issue affects Live Sports Streamthunder: from n/a through <= 2.1.
Product
Live Sports Streamthunder
Affected
up to 2.1
What to do
Affects up to 2.1. Update Live Sports Streamthunder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025WP Email Delivery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs WP Email Delivery wp-email-delivery allows Reflected XSS.This issue affects WP Email Delivery: from n/a through <= 1.20.11.23.
Product
WP Email Delivery
Affected
up to 1.20.11.23
What to do
Affects up to 1.20.11.23. Update WP Email Delivery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Print Invoice & Delivery Notes for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-49239 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.5.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025KI Live Video Conferences: Missing AuthorizationCVE-2025-23971 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
Product
KI Live Video Conferences
Affected
up to 5.5.15
What to do
Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025KI Live Video Conferences: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-23969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Retrieve Embedded Sensitive Data.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
Product
KI Live Video Conferences
Affected
up to 5.5.15
What to do
Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for: Cross-Site Request ForgeryCVE-2025-5019 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the hs_update_ai_chat_settings() function. This makes it possible for unauthenticated attackers to reconfigure the plugin’s AI/chat settings (including API keys) and to potentially redirect notifications or leak data to attacker-controlled endpoints via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 20, 2025Order Delivery Date: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-2929 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Order Delivery Date
Fixed in
12.4.0
What to do
Update Order Delivery Date to 12.4.0 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025Broadcast Live Video: Cross-Site Request Forgery (CSRF)CVE-2025-48255 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery.This issue affects Broadcast Live Video: from n/a through <= 6.2.4.
Product
Broadcast Live Video
Affected
up to 6.2.4
What to do
Affects up to 6.2.4. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025LiveAgent: Cross-Site Request Forgery (CSRF)CVE-2025-47667 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in qusupport LiveAgent liveagent allows Cross Site Request Forgery.This issue affects LiveAgent: from n/a through <= 4.4.7.
Product
LiveAgent
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update LiveAgent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Soccer Live Scores: Cross-Site Request Forgery (CSRF)CVE-2025-47594 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Soccer Live Scores allows Cross Site Request Forgery. This issue affects Soccer Live Scores: from n/a through 1.0.5.
Product
Soccer Live Scores
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Soccer Live Scores to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 26, 2025Order Delivery Date: Does not have authorization and CSRF checksCVE-2025-2907 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.
Product
Order Delivery Date
Fixed in
12.3.1
What to do
Update Order Delivery Date to 12.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2025Zalo Official Live Chat: Cross-Site Request Forgery (CSRF)CVE-2025-46498 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in nghialuu Zalo Official Live Chat zalo-official-live-chat allows Cross Site Request Forgery.This issue affects Zalo Official Live Chat: from n/a through <= 1.0.0.
Product
Zalo Official Live Chat
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Zalo Official Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Deliver via Shipos for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matat Technologies Deliver via Shipos for WooCommerce wc-shipos-delivery allows Reflected XSS.This issue affects Deliver via Shipos for WooCommerce: from n/a through <= 2.1.7.
Product
Deliver via Shipos for WooCommerce
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Deliver via Shipos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025CHATLIVE: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-27302 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Claudio Adrian Marrero CHATLIVE chatlive allows SQL Injection.This issue affects CHATLIVE: from n/a through <= 2.0.1.
Product
CHATLIVE
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update CHATLIVE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Live css: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27295 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpion Live css css-live allows Stored XSS.This issue affects Live css: from n/a through <= 1.3.
Product
Live css
Affected
up to 1.3
What to do
Affects up to 1.3. Update Live css to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Live Forms: Missing AuthorizationCVE-2025-39560 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4.
Product
Live Forms
Affected
up to 4.8.4
What to do
Affects up to 4.8.4. Update Live Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025WordPress SMTP Service, Email Delivery Solved! — MailHawk: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31015 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Adrian Tobey WordPress SMTP Service, Email Delivery Solved! — MailHawk mailhawk allows PHP Local File Inclusion.This issue affects WordPress SMTP Service, Email Delivery Solved! — MailHawk: from n/a through <= 1.3.1.
Product
WordPress SMTP Service, Email Delivery Solved! — MailHawk
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WordPress SMTP Service, Email Delivery Solved! — MailHawk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Czater.pl – live chat i telefon: Missing AuthorizationCVE-2025-32624 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in czater Czater.pl – live chat i telefon czater allows Cross Site Request Forgery.This issue affects Czater.pl – live chat i telefon: from n/a through <= 1.0.5.
Product
Czater.pl – live chat i telefon
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Czater.pl – live chat i telefon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Windows Live Writer: Cross-Site Request Forgery (CSRF)CVE-2025-32480 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dalziel Windows Live Writer windows-live-writer allows Stored XSS.This issue affects Windows Live Writer: from n/a through <= 0.1.
Product
Windows Live Writer
Affected
up to 0.1
What to do
Affects up to 0.1. Update Windows Live Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025FrescoChat Live Chat: Cross-Site Request Forgery (CSRF)CVE-2025-31383 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sodena FrescoChat Live Chat flexytalk-widget allows Stored XSS.This issue affects FrescoChat Live Chat: from n/a through <= 3.2.6.
Product
FrescoChat Live Chat
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update FrescoChat Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2025Live Forms: Missing AuthorizationCVE-2025-32279 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjada Live Forms liveforms.This issue affects Live Forms: from n/a through <= 4.8.5.
Product
Live Forms
Affected
up to 4.8.5
What to do
Affects up to 4.8.5. Update Live Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Ultimate Live Cricket WordPress Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazycric Ultimate Live Cricket WordPress Lite ultimate-live-cricket-lite allows Stored XSS.This issue affects Ultimate Live Cricket WordPress Lite: from n/a through <= 1.4.2.
Product
Ultimate Live Cricket WordPress Lite
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Ultimate Live Cricket WordPress Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Live Forms: Missing AuthorizationCVE-2025-30809 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4.
Product
Live Forms
Affected
up to 4.8.4
What to do
Affects up to 4.8.4. Update Live Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Zalo Live Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26542 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dang Ngoc Binh Zalo Live Chat zalo-live-chat allows Reflected XSS.This issue affects Zalo Live Chat: from n/a through <= 1.1.0.
Product
Zalo Live Chat
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Zalo Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2025FoodBakery | Delivery Restaurant Directory: Cross-Site Request ForgeryCVE-2024-13933 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7. This is due to missing or incorrect nonce validation on the foodbakery_var_backup_file_delete, foodbakery_widget_file_delete, theme_option_save, export_widget_settings, ajax_import_widget_data, foodbakery_var_settings_backup_generate, foodbakery_var_backup_file_restore, and theme_option_rest_all functions. This makes it possible for unauthenticated attackers to delete arbitrary files, update theme options, export widget options, import widget options, generate backups, restore backups, and reset theme options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
FoodBakery | Delivery Restaurant Directory
Affected
up to 4.7
What to do
Affects up to 4.7. Update FoodBakery | Delivery Restaurant Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 19, 2025FoodBakery | Delivery Restaurant Directory: Unauthorized access of data and modification of dataCVE-2024-12920 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the foodbakery_var_backup_file_delete, foodbakery_widget_file_delete, theme_option_save, export_widget_settings, ajax_import_widget_data, foodbakery_var_settings_backup_generate, foodbakery_var_backup_file_restore, and theme_option_rest_all functions in all versions up to, and including, 4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files, update theme options, export widget options, import widget options, generate backups, restore backups, and reset theme options.
Product
FoodBakery | Delivery Restaurant Directory
Affected
up to 4.7
What to do
Affects up to 4.7. Update FoodBakery | Delivery Restaurant Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 8, 2025Print Invoice & Delivery Notes for WooCommerce: Sensitive Information ExposureCVE-2024-13640 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.4.1 via the 'wcdn/invoice' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/wcdn/invoice directory which can contain invoice files if an email attachment setting is enabled.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2025Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce: Unauthorized accessCVE-2024-13811 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_import_lafka' AJAX actions in all versions up to, and including, 4.5.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo data that overrides the site.
Product
Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce
Affected
up to 4.5.7
What to do
Affects up to 4.5.7. Update Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 1, 2025Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: Server-Side Request ForgeryCVE-2024-13697 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nice_links'. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Successful exploitation requires the "Enable link previews" to be enabled (default).
Product
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 1, 2025Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: Sensitive Information ExposureCVE-2024-13611 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/bp-better-messages directory which can contain file attachments included in chat messages.
Product
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Site Mailer – SMTP Replacement, Email API Deliverability & Email Log: Stored Cross-Site ScriptingCVE-2025-1319 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Site Mailer – SMTP Replacement, Email API Deliverability & Email Log
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Site Mailer – SMTP Replacement, Email API Deliverability & Email Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 25, 2025Broadcast Live Video: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26753 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through <= 6.2.
Product
Broadcast Live Video
Affected
up to 6.2
What to do
Affects up to 6.2. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Broadcast Live Video: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26752 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through <= 6.2.
Product
Broadcast Live Video
Affected
up to 6.2
What to do
Affects up to 6.2. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Live Streaming Video Player – by SRS Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27327 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Winlin Live Streaming Video Player – by SRS Player srs-player allows DOM-Based XSS.This issue affects Live Streaming Video Player – by SRS Player: from n/a through <= 1.0.18.
Product
Live Streaming Video Player – by SRS Player
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update Live Streaming Video Player – by SRS Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.