Updated 59 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

589new WordPress flaws this week

398,319entries in the database

41,459 results · page 337 of 830

Jun 17, 2025Spare: Deserialization of Untrusted DataCVE-2025-31919 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7.
Product
Spare
Affected
up to 1.7
What to do
Affects up to 1.7. Update Spare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Elite Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30988 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Stored XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.
Product
Elite Video Player
Affected
up to 10.0.5
What to do
Affects up to 10.0.5. Update Elite Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Rapyd Payment Extension for WooCommerce: Deserialization of Untrusted DataCVE-2025-30618 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce rapyd-payments allows Object Injection.This issue affects Rapyd Payment Extension for WooCommerce: from n/a through <= 1.2.0.
Product
Rapyd Payment Extension for WooCommerce
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Rapyd Payment Extension for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Navigation Tree Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30562 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdistillery Navigation Tree Elementor navigation-tree-elementor allows Blind SQL Injection.This issue affects Navigation Tree Elementor: from n/a through <= 1.0.1.
Product
Navigation Tree Elementor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Navigation Tree Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Simen: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-29002 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Simen snssimen allows PHP Local File Inclusion.This issue affects Simen: from n/a through <= 4.6.
Product
Simen
Affected
up to 4.6
What to do
Affects up to 4.6. Update Simen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Evon: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28991 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Evon snsevon allows PHP Local File Inclusion.This issue affects Evon: from n/a through <= 3.4.
Product
Evon
Affected
up to 3.4
What to do
Affects up to 3.4. Update Evon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025WP Employee Attendance System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28972 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System wp-employee-attendance-system allows Blind SQL Injection.This issue affects WP Employee Attendance System: from n/a through <= 3.5.
Product
WP Employee Attendance System
Affected
up to 3.5
What to do
Affects up to 3.5. Update WP Employee Attendance System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025WPCRM - CRM for Contact form CF7 & WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows SQL Injection.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.
Product
WPCRM - CRM for Contact form CF7 & WooCommerce
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update WPCRM - CRM for Contact form CF7 & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025DSK: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24761 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK dsk allows PHP Local File Inclusion.This issue affects DSK: from n/a through < 2.4.
Product
DSK
What to do
Update DSK to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Simple Logo Carousel: Stored Cross-Site ScriptingCVE-2025-5700 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Logo Carousel
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update Simple Logo Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 17, 2025Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2025-5291 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide shortcodes in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.10.8
What to do
Affects up to 3.10.8. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Unauthorized modification of dataCVE-2025-3880 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the email address for the account connection, and disconnect the plugin. Previously created content will still be displayed and functional if the account is disconnected.
Product
Poll, Survey & Quiz Maker Plugin by Opinion Stage
Affected
up to 19.9.0
What to do
Affects up to 19.9.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2025Drag and Drop Multiple File Upload for Contact Form 7: Arbitrary file uploadsCVE-2025-3515 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.8.9
What to do
Affects up to 1.3.8.9. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2025Ivory Search: Does not sanitise and escape some of its settingsCVE-2025-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Ivory Search
Fixed in
5.5.10
What to do
Update Ivory Search to 5.5.10 or newer.
Full record and what to do →NVD record wpscan.com
Jun 16, 2025Blog2Social: Social Media Auto Post & Scheduler: SQL InjectionCVE-2025-5673 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the ‘prgSortPostType’ parameter in all versions up to, and including, 8.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 8.4.4
What to do
Affects up to 8.4.4. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 16, 2025WordPress Infinite Scroll – Ajax Load More: Stored Cross-Site ScriptingCVE-2025-4775 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Infinite Scroll – Ajax Load More
Affected
up to 7.4.0.1
What to do
Affects up to 7.4.0.1. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 16, 2025Wise Chat: Stored Cross-Site ScriptingCVE-2025-3774 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wise Chat
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update Wise Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025Slider, Gallery, and Carousel by MetaSlider: Stored Cross-Site ScriptingCVE-2025-5337 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ parameter in all versions up to, and including, 3.98.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider, Gallery, and Carousel by MetaSlider
Affected
up to 3.98.0
What to do
Affects up to 3.98.0. Update Slider, Gallery, and Carousel by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2025YITH WooCommerce Wishlist: Stored Cross-Site ScriptingCVE-2025-5238 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
YITH WooCommerce Wishlist
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update YITH WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.yithemes.com plugins.svn.wordpress.org
Jun 14, 2025Appointment Booking Calendar — Simply Schedule Appointments Booking: Stored Cross-Site ScriptingCVE-2025-4667 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ssa_admin_upcoming_appointments, ssa_admin_upcoming_appointments, and ssa_past_appointments shortcodes in all versions up to, and including, 1.6.8.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.8.30
What to do
Affects up to 1.6.8.30. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2025Restrict File Access: Directory TraversalCVE-2025-6070 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Restrict File Access
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Restrict File Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025Image Resizer On The Fly: Arbitrary file deletionCVE-2025-6065 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' task in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Image Resizer On The Fly
Affected
up to 1.1
What to do
Affects up to 1.1. Update Image Resizer On The Fly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 14, 2025WP URL Shortener: Cross-Site Request ForgeryCVE-2025-6064 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the 'url_shortener_settings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP URL Shortener
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025XiSearch bar: Cross-Site Request ForgeryCVE-2025-6063 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The XiSearch bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6. This is due to missing or incorrect nonce validation on the 'xisearch-key-config' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
XiSearch bar
Affected
up to 2.6
What to do
Affects up to 2.6. Update XiSearch bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025Yougler Blogger Profile Page: Cross-Site Request ForgeryCVE-2025-6062 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Yougler Blogger Profile Page
Affected
up to v1.01
What to do
Affects up to v1.01. Update Yougler Blogger Profile Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025kk Youtube Video: Stored Cross-Site ScriptingCVE-2025-6061 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The kk Youtube Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kkytv' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
kk Youtube Video
Affected
up to 0.2
What to do
Affects up to 0.2. Update kk Youtube Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025Zen Sticky Social: Cross-Site Request ForgeryCVE-2025-6055 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Zen Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Zen Sticky Social
Affected
up to 0.3
What to do
Affects up to 0.3. Update Zen Sticky Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025Easy Flashcards: Cross-Site Request ForgeryCVE-2025-6040 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'ef_settings_submenu' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Flashcards
Affected
up to 0.1
What to do
Affects up to 0.1. Update Easy Flashcards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 14, 2025StreamWeasels Kick Integration: Stored Cross-Site ScriptingCVE-2025-5589 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘status-classic-offline-text’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
StreamWeasels Kick Integration
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update StreamWeasels Kick Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2025Click to Chat: Stored Cross-Site ScriptingCVE-2025-5336 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Click to Chat
Affected
up to 4.22
What to do
Affects up to 4.22. Update Click to Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2025AI Image Lab – Free AI Image Generator: Cross-Site Request ForgeryCVE-2025-4592 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Image Lab – Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
AI Image Lab – Free AI Image Generator
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update AI Image Lab – Free AI Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025DIOT SCADA with MQTT: Stored Cross-Site ScriptingCVE-2025-4216 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DIOT SCADA with MQTT
Affected
up to 1.0.5.1
What to do
Affects up to 1.0.5.1. Update DIOT SCADA with MQTT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2025Zagg - Electronics & Accessories WooCommerce: Local File InclusionCVE-2025-4200 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the load_view() function that is called via at least three AJAX actions: 'load_more_post', 'load_shop', and 'load_more_product. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Zagg - Electronics & Accessories WooCommerce
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Zagg - Electronics & Accessories WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 14, 2025UserPro - Community and User Profile: Directory TraversalCVE-2025-4187 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The UserPro - Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.10 via the userpro_fbconnect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
UserPro - Community and User Profile
Affected
up to 5.1.10
What to do
Affects up to 5.1.10. Update UserPro - Community and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jun 14, 2025AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Time-based SQL InjectionCVE-2025-5487 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the field_conditions parameter in all versions up to, and including, 5.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Administrators can configure the plugin to allow access to this functionality to authors and higher.
Product
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2025File Manager Pro – Filester: Arbitrary file uploadsCVE-2025-3234 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.8.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Administrators have the ability to extend file manager usage privileges to lower-level users including subscribers, which would make this vulnerability more severe on such sites.
Product
File Manager Pro – Filester
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 13, 2025Seraphinite Accelerator: Cross-Site Request ForgeryCVE-2025-6059 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Seraphinite Accelerator
Affected
up to 2.27.21
What to do
Affects up to 2.27.21. Update Seraphinite Accelerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2025Auto Attachments: Stored Cross-Site ScriptingCVE-2025-6012 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Auto Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Auto Attachments
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Auto Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Jun 13, 2025Game Review Block: Stored Cross-Site ScriptingCVE-2025-5923 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Game Review Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Game Review Block
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update Game Review Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 13, 2025Traffic Monitor: Unauthorized modification of dataCVE-2025-5815 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.
Product
Traffic Monitor
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Traffic Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2025WP Travel Engine – Tour Booking Plugin – Tour Operator Software: Unauthorized loss of dataCVE-2025-5282 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025IndieBlocks: Stored Cross-Site ScriptingCVE-2025-5950 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
IndieBlocks
Affected
up to 0.13.2
What to do
Affects up to 0.13.2. Update IndieBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2025Telegram for WP: Stored Cross-Site ScriptingCVE-2025-5939 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Telegram for WP
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Telegram for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 12, 2025Digital Marketing and Agency Templates Addons for Elementor: Cross-Site Request ForgeryCVE-2025-5938 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the import_templates() function. This makes it possible for unauthenticated attackers to trigger an import via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Digital Marketing and Agency Templates Addons for Elementor
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Digital Marketing and Agency Templates Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025WP2HTML: Cross-Site Request ForgeryCVE-2025-5930 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP2HTML
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP2HTML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025WP Sliding Login/Dashboard Panel: Cross-Site Request ForgeryCVE-2025-5928 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Sliding Login/Dashboard Panel
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update WP Sliding Login/Dashboard Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025Link Shield: Cross-Site Request ForgeryCVE-2025-5926 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the link_shield_menu_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Link Shield
Affected
up to 0.5.4
What to do
Affects up to 0.5.4. Update Link Shield to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025ACF Onyx Poll: Stored Cross-Site ScriptingCVE-2025-5841 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ACF Onyx Poll
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update ACF Onyx Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2025REST API | Custom API Generator For Cross Platform And Import Export In WP: Privilege EscalationCVE-2025-5288 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
Product
REST API | Custom API Generator For Cross Platform And Import Export In WP
Affected
1.0.0 to 2.0.3
What to do
Affects 1.0.0 to 2.0.3. Update REST API | Custom API Generator For Cross Platform And Import Export In WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 12, 2025Color Palette: Stored Cross-Site ScriptingCVE-2025-5233 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hex’ parameter in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Color Palette
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update Color Palette to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.