Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,657 results · page 31 of 94
May 7, 2025theMarketer: Cross-Site Request Forgery (CSRF)CVE-2025-47655 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in themarketer2023 theMarketer themarketer allows Stored XSS.This issue affects theMarketer: from n/a through <= 1.4.7.
- Product
- theMarketer
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update theMarketer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Pays – WooCommerce Payment Gateway: Cross-Site Request Forgery (CSRF)CVE-2025-47648 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through <= 2.6.
- Product
- Pays – WooCommerce Payment Gateway
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Pays – WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Sidebar Manager Light: Cross-Site Request Forgery (CSRF)CVE-2025-47647 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light sidebar-manager-light allows Cross Site Request Forgery.This issue affects Sidebar Manager Light: from n/a through <= 1.18.
- Product
- Sidebar Manager Light
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Sidebar Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Supertext Translation and Proofreading: Cross-Site Request Forgery (CSRF)CVE-2025-47639 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Supertext Supertext Translation and Proofreading polylang-supertext allows Stored XSS.This issue affects Supertext Translation and Proofreading: from n/a through <= 4.26.
- Product
- Supertext Translation and Proofreading
- Affected
- up to 4.26
- What to do
- Affects up to 4.26. Update Supertext Translation and Proofreading to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WebinarPress: Server-Side Request Forgery (SSRF)CVE-2025-47635 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Server Side Request Forgery.This issue affects WebinarPress: from n/a through <= 1.33.28.
- Product
- WebinarPress
- Affected
- up to 1.33.28
- What to do
- Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Awin – Advertiser Tracking for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-47633 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Awin Awin – Advertiser Tracking for WooCommerce awin-advertiser-tracking allows Cross Site Request Forgery.This issue affects Awin – Advertiser Tracking for WooCommerce: from n/a through <= 2.0.0.
- Product
- Awin – Advertiser Tracking for WooCommerce
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Awin – Advertiser Tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025DoFollow Case by Case: Cross-Site Request Forgery (CSRF)CVE-2025-47624 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
- Product
- DoFollow Case by Case
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Martins Free Monetized Ad Exchange Network: Cross-Site Request Forgery (CSRF)CVE-2025-47620 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bundgaard Martins Free Monetized Ad Exchange Network martins-free-and-easy-ad-network-get-more-visitors allows Reflected XSS.This issue affects Martins Free Monetized Ad Exchange Network: from n/a through <= 1.0.6.
- Product
- Martins Free Monetized Ad Exchange Network
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Martins Free Monetized Ad Exchange Network to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025LessButtons Social Sharing and Statistics: Cross-Site Request Forgery (CSRF)CVE-2025-47614 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Chris Clark LessButtons Social Sharing and Statistics lessbuttons allows Cross Site Request Forgery.This issue affects LessButtons Social Sharing and Statistics: from n/a through <= 1.6.1.
- Product
- LessButtons Social Sharing and Statistics
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update LessButtons Social Sharing and Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025EasyMe Connect: Cross-Site Request Forgery (CSRF)CVE-2025-47609 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in easymebiz EasyMe Connect easyme-connect allows Cross Site Request Forgery.This issue affects EasyMe Connect: from n/a through <= 3.0.3.
- Product
- EasyMe Connect
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update EasyMe Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Simple Giveaways: Cross-Site Request Forgery (CSRF)CVE-2025-47606 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways giveasap allows Cross Site Request Forgery.This issue affects Simple Giveaways: from n/a through <= 2.49.0.
- Product
- Simple Giveaways
- Affected
- up to 2.49.0
- What to do
- Affects up to 2.49.0. Update Simple Giveaways to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Podcasts Manager: Cross-Site Request Forgery (CSRF)CVE-2025-47597 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Maulik Vora WP Podcasts Manager wp-podcasts-manager allows Cross Site Request Forgery.This issue affects WP Podcasts Manager: from n/a through <= 1.3.
- Product
- WP Podcasts Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update WP Podcasts Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Beacon Lead Magnets and Lead Capture: Cross-Site Request Forgery (CSRF)CVE-2025-47596 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Cross Site Request Forgery.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.8.
- Product
- Beacon Lead Magnets and Lead Capture
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Beacon Lead Magnets and Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Soccer Live Scores: Cross-Site Request Forgery (CSRF)CVE-2025-47594 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Soccer Live Scores allows Cross Site Request Forgery. This issue affects Soccer Live Scores: from n/a through 1.0.5.
- Product
- Soccer Live Scores
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Soccer Live Scores to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WPSpeed: Cross-Site Request Forgery (CSRF)CVE-2025-47590 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in JExtensions Store WPSpeed wpspeed allows Cross Site Request Forgery.This issue affects WPSpeed: from n/a through <= 2.6.5.
- Product
- WPSpeed
- Affected
- up to 2.6.5
- What to do
- Affects up to 2.6.5. Update WPSpeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Wiki Embed: Cross-Site Request Forgery (CSRF)CVE-2025-47551 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ctltwp Wiki Embed wiki-embed allows Cross Site Request Forgery.This issue affects Wiki Embed: from n/a through <= 1.4.6.
- Product
- Wiki Embed
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Wiki Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Wbcom Designs - Activity Link Preview For BuddyPress: Server-Side Request Forgery (SSRF)CVE-2025-47548 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress activity-link-preview-for-buddypress allows Server Side Request Forgery.This issue affects Wbcom Designs - Activity Link Preview For BuddyPress: from n/a through <= 1.4.4.
- Product
- Wbcom Designs - Activity Link Preview For BuddyPress
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Wbcom Designs - Activity Link Preview For BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Compress: Cross-Site Request Forgery (CSRF)CVE-2025-47546 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Cross Site Request Forgery.This issue affects WP Compress: from n/a through <= 6.30.30.
- Product
- WP Compress
- Affected
- up to 6.30.30
- What to do
- Affects up to 6.30.30. Update WP Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025TrueBooker: Cross-Site Request Forgery (CSRF)CVE-2025-47543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Cross Site Request Forgery.This issue affects TrueBooker: from n/a through <= 1.0.7.
- Product
- TrueBooker
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Simple calendar for Elementor: Cross-Site Request Forgery (CSRF)CVE-2025-47542 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through <= 1.6.5.
- Product
- Simple calendar for Elementor
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Simple calendar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Graphina: Cross-Site Request Forgery (CSRF)CVE-2025-47533 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows PHP Local File Inclusion.This issue affects Graphina: from n/a through <= 3.0.4.
- Product
- Graphina
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Graphina to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Seznam Webmaster: Cross-Site Request Forgery (CSRF)CVE-2025-47523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Lukáš Hartmann Seznam Webmaster seznam-webmaster allows Cross Site Request Forgery.This issue affects Seznam Webmaster: from n/a through <= 1.4.7.
- Product
- Seznam Webmaster
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Seznam Webmaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Easy PayPal Events: Cross-Site Request Forgery (CSRF)CVE-2025-47519 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal Events easy-paypal-events-tickets allows Cross Site Request Forgery.This issue affects Easy PayPal Events: from n/a through <= 1.2.2.
- Product
- Easy PayPal Events
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Easy PayPal Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Accept Donations with PayPal & Stripe: Cross-Site Request Forgery (CSRF)CVE-2025-47517 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Stored XSS.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.4.5.
- Product
- Accept Donations with PayPal & Stripe
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Accept Donations with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025ELI's Related Posts Footer Links and Widget: Cross-Site Request Forgery (CSRF)CVE-2025-47514 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Eli ELI's Related Posts Footer Links and Widget spostarbust allows Stored XSS.This issue affects ELI's Related Posts Footer Links and Widget: from n/a through <= 1.2.04.20.
- Product
- ELI's Related Posts Footer Links and Widget
- Affected
- up to 1.2.04.20
- What to do
- Affects up to 1.2.04.20. Update ELI's Related Posts Footer Links and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Contact Form Widget: Cross-Site Request Forgery (CSRF)CVE-2025-47491 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.4.6.
- Product
- Contact Form Widget
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Contact Form Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Display Remote Posts Block: Server-Side Request Forgery (SSRF)CVE-2025-47484 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through <= 1.1.0.
- Product
- Display Remote Posts Block
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Display Remote Posts Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Easy Replace Image: Server-Side Request Forgery (SSRF)CVE-2025-47483 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Iulia Cazan Easy Replace Image easy-replace-image allows Server Side Request Forgery.This issue affects Easy Replace Image: from n/a through <= 3.5.0.
- Product
- Easy Replace Image
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update Easy Replace Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025PW WooCommerce Bulk Edit: Cross-Site Request Forgery (CSRF)CVE-2025-47473 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in pimwick PW WooCommerce Bulk Edit pw-bulk-edit allows Cross Site Request Forgery.This issue affects PW WooCommerce Bulk Edit: from n/a through <= 2.134.
- Product
- PW WooCommerce Bulk Edit
- Affected
- up to 2.134
- What to do
- Affects up to 2.134. Update PW WooCommerce Bulk Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025GPT3 AI Content Writer: Cross-Site Request Forgery (CSRF)CVE-2025-47470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in senols GPT3 AI Content Writer gpt3-ai-content-generator allows Cross Site Request Forgery.This issue affects GPT3 AI Content Writer: from n/a through <= 1.9.14.
- Product
- GPT3 AI Content Writer
- Affected
- up to 1.9.14
- What to do
- Affects up to 1.9.14. Update GPT3 AI Content Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Hash Form: Cross-Site Request Forgery (CSRF)CVE-2025-47468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in hashthemes Hash Form hash-form allows Cross Site Request Forgery.This issue affects Hash Form: from n/a through <= 1.2.8.
- Product
- Hash Form
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Hash Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Ultimate WP Mail: Cross-Site Request Forgery (CSRF)CVE-2025-47466 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Cross Site Request Forgery.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.
- Product
- Ultimate WP Mail
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Solace Extra: Server-Side Request Forgery (SSRF)CVE-2025-47464 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.1.
- Product
- Solace Extra
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Solace Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Challan: Cross-Site Request Forgery (CSRF)CVE-2025-47462 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in WebAppick Challan webappick-pdf-invoice-for-woocommerce allows Privilege Escalation.This issue affects Challan: from n/a through <= 3.7.58.
- Product
- Challan
- Affected
- up to 3.7.58
- What to do
- Affects up to 3.7.58. Update Challan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025FundEngine: Cross-Site Request Forgery (CSRF)CVE-2025-47459 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Roxnor FundEngine wp-fundraising-donation allows Cross Site Request Forgery.This issue affects FundEngine: from n/a through <= 1.7.3.
- Product
- FundEngine
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update FundEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Product Quantity Dropdown For Woocommerce: Cross-Site Request Forgery (CSRF)CVE-2025-47451 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Product Quantity Dropdown For Woocommerce product-quantity-dropdown-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Quantity Dropdown For Woocommerce: from n/a through <= 1.2.
- Product
- Product Quantity Dropdown For Woocommerce
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Product Quantity Dropdown For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Hotel Booking: Cross-Site Request Forgery (CSRF)CVE-2025-47448 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Booking: from n/a through <= 2.1.9.
- Product
- WP Hotel Booking
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Cool Author Box: Cross-Site Request Forgery (CSRF)CVE-2025-47447 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak Cool Author Box hm-cool-author-box-widget allows Cross Site Request Forgery.This issue affects Cool Author Box: from n/a through <= 3.0.0.
- Product
- Cool Author Box
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Cool Author Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Listamester: Cross-Site Request Forgery (CSRF)CVE-2025-47446 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in listamester Listamester listamester allows Cross Site Request Forgery.This issue affects Listamester: from n/a through <= 2.3.6.
- Product
- Listamester
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025AHAthat: Cross-Site Request ForgeryCVE-2025-4337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the aha_plugin_page() function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- AHAthat
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2025Abundatrade: Cross-Site Request ForgeryCVE-2025-4199 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Abundatrade
- Affected
- up to 1.8.02
- What to do
- Affects up to 1.8.02. Update Abundatrade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 2, 2025Alink Tap: Cross-Site Request ForgeryCVE-2025-4198 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Alink Tap
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Alink Tap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 2, 2025Advanced Reorder Image Text Slider: Cross-Site Request ForgeryCVE-2025-4188 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'reorder-simple-image-text-slider-setting' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Advanced Reorder Image Text Slider
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Advanced Reorder Image Text Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 1, 2025Gravity Forms WebHooks: Server-Side Request ForgeryCVE-2024-13845 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'process_feed' method of the GF_Webhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Gravity Forms WebHooks
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Gravity Forms WebHooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgravityforms.comwordfence.com
May 1, 2025NewsBlogger: Cross-Site Request ForgeryCVE-2025-1305 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- NewsBlogger
- Affected
- up to 0.2.5.4
- What to do
- Affects up to 0.2.5.4. Update NewsBlogger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Apr 25, 20251 Decembrie 1918: Cross-Site Request ForgeryCVE-2025-3870 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing or incorrect nonce validation on the 1-decembrie-1918/1-decembrie-1918.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- 1 Decembrie 1918
- Affected
- up to 1.dec.2012
- What to do
- Affects up to 1.dec.2012. Update 1 Decembrie 1918 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 25, 2025Ajax Comment Form CST: Cross-Site Request ForgeryCVE-2025-3867 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation via the 'acform_cst_settings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ajax Comment Form CST
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Ajax Comment Form CST to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Apr 25, 2025Add Google +1 (Plus one) social share Button: Cross-Site Request ForgeryCVE-2025-3866 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the google-plus-one-share-button page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Add Google +1 (Plus one) social share Button
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Add Google +1 (Plus one) social share Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 25, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor): Server-Side Request ForgeryCVE-2025-3775 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services.
- Product
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor)
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 24, 2025WP AVCL Automation Helper (formerly WPFlyLeads): Server-Side Request Forgery (SSRF)CVE-2025-46531 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery.This issue affects WP AVCL Automation Helper (formerly WPFlyLeads): from n/a through <= 3.4.
- Product
- WP AVCL Automation Helper (formerly WPFlyLeads)
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update WP AVCL Automation Helper (formerly WPFlyLeads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.