Vulnerability database

41,459 results · page 336 of 830

• Jun 17, 2025FunnelKit Automations: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-49868 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.6.0.

  Product

  FunnelKit Automations

  Affected

  up to 3.6.0

  What to do

  Affects up to 3.6.0. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Advanced Settings: Cross-Site Request Forgery (CSRF)CVE-2025-49865 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanced Settings: from n/a through <= 3.0.1.

  Product

  Advanced Settings

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Advanced Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025AFS Analytics: Missing AuthorizationCVE-2025-49864 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in AFS Analytics AFS Analytics addfreestats allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AFS Analytics: from n/a through <= 4.21.

  Product

  AFS Analytics

  Affected

  up to 4.21

  What to do

  Affects up to 4.21. Update AFS Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Advanced Sermons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49863 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored XSS.This issue affects Advanced Sermons: from n/a through <= 3.6.

  Product

  Advanced Sermons

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Ebook Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49862 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allows Stored XSS.This issue affects Ebook Store: from n/a through <= 5.8008.

  Product

  Ebook Store

  Affected

  up to 5.8008

  What to do

  Affects up to 5.8008. Update Ebook Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Kama Click Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49861 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows Stored XSS.This issue affects Kama Click Counter: from n/a through <= 4.0.3.

  Product

  Kama Click Counter

  Affected

  up to 4.0.3

  What to do

  Affects up to 4.0.3. Update Kama Click Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WP Views Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49859 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This issue affects WP Views Counter: from n/a through <= 2.0.3.

  Product

  WP Views Counter

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update WP Views Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Arconix Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49858 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.17.

  Product

  Arconix Shortcodes

  Affected

  up to 2.1.17

  What to do

  Affects up to 2.1.17. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025myCred: Missing AuthorizationCVE-2025-49857 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.4.2.

  Product

  myCred

  Affected

  up to 2.9.4.2

  What to do

  Affects up to 2.9.4.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Responsive Plus: Cross-Site Request Forgery (CSRF)CVE-2025-49856 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsive Plus: from n/a through <= 3.2.2.

  Product

  Responsive Plus

  Affected

  up to 3.2.2

  What to do

  Affects up to 3.2.2. Update Responsive Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Meks Flexible Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49855 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes allows DOM-Based XSS.This issue affects Meks Flexible Shortcodes: from n/a through <= 1.3.7.

  Product

  Meks Flexible Shortcodes

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update Meks Flexible Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Slim SEO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49854 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anh Tran Slim SEO slim-seo allows SQL Injection.This issue affects Slim SEO: from n/a through <= 4.5.4.

  Product

  Slim SEO

  Affected

  up to 4.5.4

  What to do

  Affects up to 4.5.4. Update Slim SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025CozyStay: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49508 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.7.1.

  Product

  CozyStay

  What to do

  Update CozyStay to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025PostaPanduri: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49452 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Ladó PostaPanduri postapanduri allows SQL Injection.This issue affects PostaPanduri: from n/a through <= 2.1.3.

  Product

  PostaPanduri

  Affected

  up to 2.1.3

  What to do

  Affects up to 2.1.3. Update PostaPanduri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: Path Traversal: '.../...//'CVE-2025-49451 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: from n/a through <= 1.0.13.

  Product

  Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery

  Affected

  up to 1.0.13

  What to do

  Affects up to 1.0.13. Update Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025FW Food Menu: Unrestricted Upload of File with Dangerous TypeCVE-2025-49447 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects FW Food Menu : from n/a through 6.0.0.

  Product

  FW Food Menu

  Affected

  up to 6.0.0

  What to do

  Affects up to 6.0.0. Update FW Food Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Reformer for Elementor: Unrestricted Upload of File with Dangerous TypeCVE-2025-49444 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server.This issue affects Reformer for Elementor: from n/a through <= 1.0.5.

  Product

  Reformer for Elementor

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Reformer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025FW Gallery: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-49415 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Path Traversal.This issue affects FW Gallery: from n/a through <= 8.0.0.

  Product

  FW Gallery

  Affected

  up to 8.0.0

  What to do

  Affects up to 8.0.0. Update FW Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025eCommerce Product Catalog: Deserialization of Untrusted DataCVE-2025-49331 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through <= 3.4.3.

  Product

  eCommerce Product Catalog

  Affected

  up to 3.4.3

  What to do

  Affects up to 3.4.3. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Integration for Contact Form 7 and Zoho CRM, Bigin: Deserialization of Untrusted DataCVE-2025-49330 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through <= 1.3.0.

  Product

  Integration for Contact Form 7 and Zoho CRM, Bigin

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Integration for Contact Form 7 and Zoho CRM, Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WP2LEADS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49316 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.5.0.

  Product

  WP2LEADS

  Affected

  up to 3.5.0

  What to do

  Affects up to 3.5.0. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Echo RSS Feed Post Generator Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49312 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress rss-feed-post-generator-echo allows Reflected XSS.This issue affects Echo RSS Feed Post Generator Plugin for WordPress: from n/a through <= 5.4.8.1.

  Product

  Echo RSS Feed Post Generator Plugin for

  Affected

  up to 5.4.8.1

  What to do

  Affects up to 5.4.8.1. Update Echo RSS Feed Post Generator Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Ultimate Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49266 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Reflected XSS.This issue affects Ultimate Reviews: from n/a through <= 3.2.14.

  Product

  Ultimate Reviews

  Affected

  up to 3.2.14

  What to do

  Affects up to 3.2.14. Update Ultimate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Diza: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49261 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.8.

  Product

  Diza

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Diza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Aora: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49260 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.9.

  Product

  Aora

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update Aora to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Hara: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49259 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.10.

  Product

  Hara

  Affected

  up to 1.2.10

  What to do

  Affects up to 1.2.10. Update Hara to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Maia: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49258 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Maia maia allows PHP Local File Inclusion.This issue affects Maia: from n/a through <= 1.1.15.

  Product

  Maia

  Affected

  up to 1.1.15

  What to do

  Affects up to 1.1.15. Update Maia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Zota: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49257 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.8.

  Product

  Zota

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update Zota to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Sapa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49256 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa sapa allows PHP Local File Inclusion.This issue affects Sapa: from n/a through <= 1.1.14.

  Product

  Sapa

  Affected

  up to 1.1.14

  What to do

  Affects up to 1.1.14. Update Sapa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Ruza: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49255 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Ruza ruza allows PHP Local File Inclusion.This issue affects Ruza: from n/a through <= 1.0.7.

  Product

  Ruza

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Ruza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Nika: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49254 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.8.

  Product

  Nika

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Nika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Lasa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49253 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Lasa lasa allows PHP Local File Inclusion.This issue affects Lasa: from n/a through <= 1.1.

  Product

  Lasa

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Lasa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Besa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49252 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.8.

  Product

  Besa

  Affected

  up to 2.3.8

  What to do

  Affects up to 2.3.8. Update Besa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Fana: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49251 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.28.

  Product

  Fana

  Affected

  up to 1.1.28

  What to do

  Affects up to 1.1.28. Update Fana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WP Dummy Content Generator: Missing AuthorizationCVE-2025-49234 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through <= 3.4.6.

  Product

  WP Dummy Content Generator

  Affected

  up to 3.4.6

  What to do

  Affects up to 3.4.6. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Flozen: Unrestricted Upload of File with Dangerous TypeCVE-2025-49071 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen flozen-theme allows Upload a Web Shell to a Web Server.This issue affects Flozen: from n/a through < 1.5.1.

  Product

  Flozen

  What to do

  Update Flozen to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025eForm - WordPress Form Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48333 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPQuark eForm - WordPress Form Builder wp-fsqm-pro allows Reflected XSS.This issue affects eForm - WordPress Form Builder: from n/a through < 4.19.1.

  Product

  eForm - WordPress Form Builder

  What to do

  Update eForm - WordPress Form Builder to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WP Job Portal: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48274 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Blind SQL Injection.This issue affects WP Job Portal: from n/a through <= 2.3.2.

  Product

  WP Job Portal

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Track, Analyze & Optimize by WP Tao: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48145 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Reflected XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through <= 1.3.

  Product

  Track, Analyze & Optimize by WP Tao

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Track, Analyze & Optimize by WP Tao to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Woocommerce Partial Shipment: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48118 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpExperts Hub Woocommerce Partial Shipment wc-partial-shipment allows SQL Injection.This issue affects Woocommerce Partial Shipment: from n/a through <= 3.2.

  Product

  Woocommerce Partial Shipment

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Woocommerce Partial Shipment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025YITH PayPal Express Checkout for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48111 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.

  Product

  YITH PayPal Express Checkout for WooCommerce

  Affected

  up to 1.49.0

  What to do

  Affects up to 1.49.0. Update YITH PayPal Express Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025School Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47573 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla School Management allows Blind SQL Injection. This issue affects School Management: from n/a through 92.0.0.

  Product

  School Management

  Affected

  up to 92.0.0

  What to do

  Affects up to 92.0.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025School Management: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47572 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla School Management allows PHP Local File Inclusion. This issue affects School Management: from n/a through 93.0.0.

  Product

  School Management

  Affected

  up to 93.0.0

  What to do

  Affects up to 93.0.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025MapSVG: Unrestricted Upload of File with Dangerous TypeCVE-2025-47559 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through < 8.7.4.

  Product

  MapSVG

  What to do

  Update MapSVG to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WP VR: Unrestricted Upload of File with Dangerous TypeCVE-2025-47452 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n/a through <= 8.5.26.

  Product

  WP VR

  Affected

  up to 8.5.26

  What to do

  Affects up to 8.5.26. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Nasa Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39508 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This issue affects Nasa Core: from n/a through <= 6.4.4.

  Product

  Nasa Core

  Affected

  up to 6.4.4

  What to do

  Affects up to 6.4.4. Update Nasa Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Rankie: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39486 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Rankie valvepress-rankie allows SQL Injection.This issue affects Rankie: from n/a through < 1.8.2.

  Product

  Rankie

  What to do

  Update Rankie to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Smart Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39479 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartiolabs Smart Notification allows Blind SQL Injection. This issue affects Smart Notification: from n/a through 10.3.

  Product

  Smart Notification

  Affected

  up to 10.3

  What to do

  Affects up to 10.3. Update Smart Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025WPGYM: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32549 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPGYM allows PHP Local File Inclusion. This issue affects WPGYM: from n/a through 65.0.

  Product

  WPGYM

  Affected

  up to 65.0

  What to do

  Affects up to 65.0. Update WPGYM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 17, 2025Ovatheme Events Manager: Unrestricted Upload of File with Dangerous TypeCVE-2025-32510 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue affects Ovatheme Events Manager: from n/a through <= 1.8.4.

  Product

  Ovatheme Events Manager

  Affected

  up to 1.8.4

  What to do

  Affects up to 1.8.4. Update Ovatheme Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.