Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,657 results · page 30 of 94
Jun 6, 2025WP Online Users Stats: Cross-Site Request ForgeryCVE-2025-4966 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation within the hk_dataset_results() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Online Users Stats
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Online Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 6, 2025Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms: Cross-Site Request ForgeryCVE-2025-2935 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ss_option_maint.php' and 'ss_user_filter_list' files. This makes it possible for unauthenticated attackers to delete pending comments, and re-enable a previously blocked user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms
- Affected
- up to 2024.7
- What to do
- Affects up to 2024.7. Update Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2025Element Pack Pro: Cross-Site Request Forgery (CSRF)CVE-2025-46257 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.
- Product
- Element Pack Pro
- Fixed in
- 8.0.0
- What to do
- Update Element Pack Pro to 8.0.0 or newer.
Jun 2, 2025Contact Forms by Cimatti: Cross-Site Request Forgery (CSRF)CVE-2025-49069 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in cimatti Contact Forms by Cimatti contact-forms allows Cross Site Request Forgery.This issue affects Contact Forms by Cimatti: from n/a through <= 1.9.8.
- Product
- Contact Forms by Cimatti
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2025Simple Page Access Restriction: Cross-Site Request ForgeryCVE-2025-5142 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for unauthenticated attackers to (1) enable or disable access protection on all post types or taxonomies, (2) force every new page/post to be public or private, regardless of meta-box settings, (3) cause a silent wipe of all plugin data when it’s later removed, or (4) to conduct URL redirection attacks via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Simple Page Access Restriction
- Affected
- up to 1.0.31
- What to do
- Affects up to 1.0.31. Update Simple Page Access Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 23, 20254stats: Cross-Site Request ForgeryCVE-2025-3869 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the stats/stats.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- 4stats
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update 4stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 23, 2025occupancyplan: Cross-Site Request Forgery (CSRF)CVE-2025-46458 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in x000x occupancyplan occupancyplan allows SQL Injection.This issue affects occupancyplan: from n/a through <= 1.0.3.0.
- Product
- occupancyplan
- Affected
- up to 1.0.3.0
- What to do
- Affects up to 1.0.3.0. Update occupancyplan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025User Profile Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-48340 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through <= 1.02.
- Product
- User Profile Meta Manager
- Affected
- up to 1.02
- What to do
- Affects up to 1.02. Update User Profile Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025CheckBot: Cross-Site Request Forgery (CSRF)CVE-2025-43840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ref CheckBot checkbot allows Stored XSS.This issue affects CheckBot: from n/a through <= 1.05.
- Product
- CheckBot
- Affected
- up to 1.05
- What to do
- Affects up to 1.05. Update CheckBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025wp-cyr-cho: Cross-Site Request Forgery (CSRF)CVE-2025-43835 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ktsvetkov wp-cyr-cho wp-cyr-cho allows Cross Site Request Forgery.This issue affects wp-cyr-cho: from n/a through <= 0.1.
- Product
- wp-cyr-cho
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update wp-cyr-cho to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Salon booking system: Cross-Site Request Forgery (CSRF)CVE-2025-47583 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affects Salon booking system: from n/a through <= 10.16.
- Product
- Salon booking system
- Affected
- up to 10.16
- What to do
- Affects up to 10.16. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Easy Child Theme Creator: Cross-Site Request Forgery (CSRF)CVE-2025-39375 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ashok G Easy Child Theme Creator easy-child-theme-creator allows Cross Site Request Forgery.This issue affects Easy Child Theme Creator: from n/a through <= 1.3.1.
- Product
- Easy Child Theme Creator
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Easy Child Theme Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Best Posts Summary: Cross-Site Request Forgery (CSRF)CVE-2025-39374 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in aseem1234 Best Posts Summary best-posts-summary allows Stored XSS.This issue affects Best Posts Summary: from n/a through <= 1.0.
- Product
- Best Posts Summary
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Best Posts Summary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Author Box Plugin With Different Description: Cross-Site Request Forgery (CSRF)CVE-2025-39371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Author Box Plugin With Different Description author-box-with-different-description allows Cross Site Request Forgery.This issue affects Author Box Plugin With Different Description: from n/a through <= 1.3.5.
- Product
- Author Box Plugin With Different Description
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Author Box Plugin With Different Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Grand Restaurant: Cross-Site Request Forgery (CSRF)CVE-2025-39351 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Cross Site Request Forgery.This issue affects Grand Restaurant: from n/a through <= 7.0.
- Product
- Grand Restaurant
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Rootspersona: Cross-Site Request Forgery (CSRF)CVE-2025-48344 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ed4becky Rootspersona rootspersona allows Cross Site Request Forgery.This issue affects Rootspersona: from n/a through <= 3.7.5.
- Product
- Rootspersona
- Affected
- up to 3.7.5
- What to do
- Affects up to 3.7.5. Update Rootspersona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Dynamic Pricing & Discounts Lite for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48342 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in RedefiningTheWeb Dynamic Pricing & Discounts Lite for WooCommerce woo-dynamic-pricing-discounts-lite allows Cross Site Request Forgery.This issue affects Dynamic Pricing & Discounts Lite for WooCommerce: from n/a through <= 2.0.4.
- Product
- Dynamic Pricing & Discounts Lite for WooCommerce
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Dynamic Pricing & Discounts Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Falang multilanguage: Cross-Site Request Forgery (CSRF)CVE-2025-48285 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.61.
- Product
- Falang multilanguage
- Affected
- up to 1.3.61
- What to do
- Affects up to 1.3.61. Update Falang multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Japanized For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48284 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in shohei.tanaka Japanized For WooCommerce woocommerce-for-japan allows Cross Site Request Forgery.This issue affects Japanized For WooCommerce: from n/a through <= 2.6.40.
- Product
- Japanized For WooCommerce
- Affected
- up to 2.6.40
- What to do
- Affects up to 2.6.40. Update Japanized For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Year Make Model Search for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48265 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through <= 1.0.11.
- Product
- Year Make Model Search for WooCommerce
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Year Make Model Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Product Code for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48264 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in artiosmedia Product Code for WooCommerce product-code-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Code for WooCommerce: from n/a through <= 1.5.0.
- Product
- Product Code for WooCommerce
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Product Code for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WP Mapa Politico España: Cross-Site Request Forgery (CSRF)CVE-2025-48259 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Juan Carlos WP Mapa Politico España wp-mapa-politico-spain allows Cross Site Request Forgery.This issue affects WP Mapa Politico España: from n/a through <= 3.8.0.
- Product
- WP Mapa Politico España
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update WP Mapa Politico España to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Broadcast Live Video: Cross-Site Request Forgery (CSRF)CVE-2025-48255 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery.This issue affects Broadcast Live Video: from n/a through <= 6.2.4.
- Product
- Broadcast Live Video
- Affected
- up to 6.2.4
- What to do
- Affects up to 6.2.4. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025reCAPTCHA for all: Cross-Site Request Forgery (CSRF)CVE-2025-48243 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA for all: from n/a through <= 2.26.
- Product
- reCAPTCHA for all
- Affected
- up to 2.26
- What to do
- Affects up to 2.26. Update reCAPTCHA for all to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025AWcode Toolkit: Cross-Site Request Forgery (CSRF)CVE-2025-48238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in awcode AWcode Toolkit awcode-toolkit allows Stored XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.18.
- Product
- AWcode Toolkit
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update AWcode Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Affiliates Manager Google reCAPTCHA Integration: Cross-Site Request Forgery (CSRF)CVE-2025-48233 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in affmngr Affiliates Manager Google reCAPTCHA Integration affiliates-manager-google-recaptcha-integration allows Stored XSS.This issue affects Affiliates Manager Google reCAPTCHA Integration: from n/a through <= 1.0.6.
- Product
- Affiliates Manager Google reCAPTCHA Integration
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Affiliates Manager Google reCAPTCHA Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2025AlT Monitoring: Cross-Site Request ForgeryCVE-2025-4194 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AlT Monitoring plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the 'ALT_Monitoring_edit' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- AlT Monitoring
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update AlT Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
May 17, 2025Audio Comments: Cross-Site Request ForgeryCVE-2025-4189 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Audio Comments Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the 'audio-comments/audior-settings.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Audio Comments
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Audio Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 16, 2025SEO Flow by LupsOnline: Cross-Site Request Forgery (CSRF)CVE-2025-48146 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Michael Lups SEO Flow by LupsOnline lupsonline-link-netwerk allows Stored XSS.This issue affects SEO Flow by LupsOnline: from n/a through <= 2.2.1.
- Product
- SEO Flow by LupsOnline
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update SEO Flow by LupsOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Import Export For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48144 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.
- Product
- Import Export For WooCommerce
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Import Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025ValidateCertify: Cross-Site Request Forgery (CSRF)CVE-2025-48115 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through <= 1.6.4.
- Product
- ValidateCertify
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update ValidateCertify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025ShayanWeb Admin FontChanger: Cross-Site Request Forgery (CSRF)CVE-2025-48114 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shayan Farhang Pazhooh ShayanWeb Admin FontChanger shayanweb-admin-fontchanger allows Stored XSS.This issue affects ShayanWeb Admin FontChanger: from n/a through <= 1.9.1.
- Product
- ShayanWeb Admin FontChanger
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update ShayanWeb Admin FontChanger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025QuickCal - Appointment Booking Calendar for: Cross-Site Request Forgery (CSRF)CVE-2025-32310 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal - Appointment Booking Calendar for WordPress quickcal allows Privilege Escalation.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.
- Product
- QuickCal - Appointment Booking Calendar for
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update QuickCal - Appointment Booking Calendar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Featured Posts Scroll: Cross-Site Request Forgery (CSRF)CVE-2025-32245 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll featured-posts-scroll allows Stored XSS.This issue affects Featured Posts Scroll: from n/a through <= 1.25.
- Product
- Featured Posts Scroll
- Affected
- up to 1.25
- What to do
- Affects up to 1.25. Update Featured Posts Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025CSS3 Accordions for: Cross-Site Request Forgery (CSRF)CVE-2025-31922 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Stored XSS.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.
- Product
- CSS3 Accordions for
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update CSS3 Accordions for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025WP Ultimate Tours Builder: Cross-Site Request Forgery (CSRF)CVE-2025-31921 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Ultimate Tours Builder WP_UltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through <= 1.055.
- Product
- WP Ultimate Tours Builder
- Affected
- up to 1.055
- What to do
- Affects up to 1.055. Update WP Ultimate Tours Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Pixel WordPress Form BuilderPlugin & Autoresponder: Cross-Site Request Forgery (CSRF)CVE-2025-31915 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request Forgery.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through <= 1.0.3.
- Product
- Pixel WordPress Form BuilderPlugin & Autoresponder
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Pixel WordPress Form BuilderPlugin & Autoresponder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Spare: Cross-Site Request Forgery (CSRF)CVE-2025-31639 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themeton Spare allows Cross Site Request Forgery. This issue affects Spare: from n/a through 1.7.
- Product
- Spare
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Spare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Seven Stars: Cross-Site Request Forgery (CSRF)CVE-2025-31068 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themeton Seven Stars allows Cross Site Request Forgery. This issue affects Seven Stars: from n/a through 1.4.4.
- Product
- Seven Stars
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Seven Stars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.CVE-2024-6584 · WordPress plugins & themes · reported by WPScanCritical 9.1
The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
- Fixed in
- 3.4.7
- What to do
- Update the plugin to 3.4.7 or newer.
May 15, 2025coreActivity: Activity Logging for: Does not escape some request dataCVE-2024-0852 · WordPress plugins & themes · reported by WPScanHigh 8.8
The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin
- Product
- coreActivity: Activity Logging for
- Fixed in
- 1.8.1
- What to do
- Update coreActivity: Activity Logging for to 1.8.1 or newer.
May 15, 2025WP2LEADS: Cross-Site Request Forgery (CSRF)CVE-2025-32922 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Stored XSS.This issue affects WP2LEADS: from n/a through <= 3.5.0.
- Product
- WP2LEADS
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2025Ninja Forms Webhooks: Server-Side Request ForgeryCVE-2024-13940 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Ninja Forms Webhooks
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Ninja Forms Webhooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordninjaforms.comwordfence.com
May 7, 2025Contribuinte Checkout: Cross-Site Request Forgery (CSRF)CVE-2025-47685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Moloni Contribuinte Checkout contribuinte-checkout allows Stored XSS.This issue affects Contribuinte Checkout: from n/a through <= 2.0.03.
- Product
- Contribuinte Checkout
- Affected
- up to 2.0.03
- What to do
- Affects up to 2.0.03. Update Contribuinte Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Smaily for WP: Cross-Site Request Forgery (CSRF)CVE-2025-47684 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Smaily Smaily for WP smaily-for-wp allows Cross Site Request Forgery.This issue affects Smaily for WP: from n/a through <= 3.1.7.
- Product
- Smaily for WP
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Smaily for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Web Accessibility with Max Access: Cross-Site Request Forgery (CSRF)CVE-2025-47681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Cross Site Request Forgery.This issue affects Web Accessibility with Max Access: from n/a through <= 2.0.9.
- Product
- Web Accessibility with Max Access
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Web Accessibility with Max Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Credova_Financial: Cross-Site Request Forgery (CSRF)CVE-2025-47674 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Credova Financial Credova_Financial credova-financial allows Cross Site Request Forgery.This issue affects Credova_Financial: from n/a through <= 2.5.0.
- Product
- Credova_Financial
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Credova_Financial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025LiveAgent: Cross-Site Request Forgery (CSRF)CVE-2025-47667 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in qusupport LiveAgent liveagent allows Cross Site Request Forgery.This issue affects LiveAgent: from n/a through <= 4.4.7.
- Product
- LiveAgent
- Affected
- up to 4.4.7
- What to do
- Affects up to 4.4.7. Update LiveAgent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Pipes: Server-Side Request Forgery (SSRF)CVE-2025-47664 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery. This issue affects WP Pipes: from n/a through 1.4.2.
- Product
- WP Pipes
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025워드프레스 결제 심플페이: Cross-Site Request Forgery (CSRF)CVE-2025-47661 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Cross Site Request Forgery.This issue affects 워드프레스 결제 심플페이: from n/a through <= 5.2.11.
- Product
- 워드프레스 결제 심플페이
- Affected
- up to 5.2.11
- What to do
- Affects up to 5.2.11. Update 워드프레스 결제 심플페이 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.