Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,459 results · page 341 of 830
Jun 6, 2025HT Team Member: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49309 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Team Member ht-team-member allows Stored XSS.This issue affects HT Team Member: from n/a through <= 1.1.7.
- Product
- HT Team Member
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update HT Team Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Travel Engine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49308 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.5.1.
- Product
- WP Travel Engine
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update WP Travel Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Multilang: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49307 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magazine3 WP Multilang wp-multilang allows PHP Local File Inclusion.This issue affects WP Multilang: from n/a through <= 2.4.19.
- Product
- WP Multilang
- Affected
- up to 2.4.19
- What to do
- Affects up to 2.4.19. Update WP Multilang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49306 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.3.
- Product
- WP Social Widget
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update WP Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Product Catalog Simple: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49305 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.1.
- Product
- Product Catalog Simple
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Search with Typesense: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49304 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeManas Search with Typesense search-with-typesense allows Stored XSS.This issue affects Search with Typesense: from n/a through <= 2.0.10.
- Product
- Search with Typesense
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update Search with Typesense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Greenshift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49301 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows DOM-Based XSS.This issue affects Greenshift: from n/a through <= 11.5.5.
- Product
- Greenshift
- Affected
- up to 11.5.5
- What to do
- Affects up to 11.5.5. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WebHotelier: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49299 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPlugged.com WebHotelier webhotelier allows Stored XSS.This issue affects WebHotelier: from n/a through <= 1.9.2.
- Product
- WebHotelier
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update WebHotelier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49298 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.10.1.
- Product
- Event post
- Affected
- up to 5.10.1
- What to do
- Affects up to 5.10.1. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Crawlomatic Multisite Scraper Post Generator: Insertion of Sensitive Information Into Sent DataCVE-2025-49294 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Retrieve Embedded Sensitive Data.This issue affects Crawlomatic Multisite Scraper Post Generator: from n/a through <= 2.6.8.2.
- Product
- Crawlomatic Multisite Scraper Post Generator
- Affected
- up to 2.6.8.2
- What to do
- Affects up to 2.6.8.2. Update Crawlomatic Multisite Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Crawlomatic Multisite Scraper Post Generator: Missing AuthorizationCVE-2025-49293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crawlomatic Multisite Scraper Post Generator: from n/a through <= 2.6.8.2.
- Product
- Crawlomatic Multisite Scraper Post Generator
- Affected
- up to 2.6.8.2
- What to do
- Affects up to 2.6.8.2. Update Crawlomatic Multisite Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Profile Builder: Improper Validation of Specified Quantity in InputCVE-2025-49292 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Builder: from n/a through <= 3.13.8.
- Product
- Profile Builder
- Affected
- up to 3.13.8
- What to do
- Affects up to 3.13.8. Update Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Calculated Fields Form: Cross-Site Request Forgery (CSRF)CVE-2025-49291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.
- Product
- Calculated Fields Form
- Affected
- up to 5.3.58
- What to do
- Affects up to 5.3.58. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025PDF for WPForms: Missing AuthorizationCVE-2025-49289 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.5.0.
- Product
- PDF for WPForms
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Ultimate WP Mail: Missing AuthorizationCVE-2025-49288 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through <= 1.3.5.
- Product
- Ultimate WP Mail
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Product Feed for WooCommerce: Missing AuthorizationCVE-2025-49287 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.2.8.
- Product
- Product Feed for WooCommerce
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Table Builder: Cross-Site Request Forgery (CSRF)CVE-2025-49286 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through <= 2.0.6.
- Product
- WP Table Builder
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update WP Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Cross-Site Request Forgery (CSRF)CVE-2025-49285 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 3.8.0.
- Product
- WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Maintenance Mode & Site Under Construction: Cross-Site Request Forgery (CSRF)CVE-2025-49284 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through <= 4.3.
- Product
- WP Maintenance Mode & Site Under Construction
- Affected
- up to 4.3
- What to do
- Affects up to 4.3. Update WP Maintenance Mode & Site Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: Cross-Site Request Forgery (CSRF)CVE-2025-49283 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant gdpr-compliant-recaptcha-for-all-forms allows Cross Site Request Forgery.This issue affects Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: from n/a through <= 4.1.1.
- Product
- Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Tools: Cross-Site Request Forgery (CSRF)CVE-2025-49273 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through <= 5.24.
- Product
- WP Tools
- Affected
- up to 5.24
- What to do
- Affects up to 5.24. Update WP Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Trinity Audio: Missing AuthorizationCVE-2025-49272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.20.0.
- Product
- Trinity Audio
- Affected
- up to 5.20.0
- What to do
- Affects up to 5.20.0. Update Trinity Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP-CRM System: Missing AuthorizationCVE-2025-49270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP-CRM System: from n/a through <= 3.4.2.
- Product
- WP-CRM System
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Market Exporter: Cross-Site Request Forgery (CSRF)CVE-2025-49269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Anton Vanyukov Market Exporter market-exporter allows Cross Site Request Forgery.This issue affects Market Exporter: from n/a through <= 2.0.22.
- Product
- Market Exporter
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Verge3D: Missing AuthorizationCVE-2025-49268 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verge3D: from n/a through <= 4.9.4.
- Product
- Verge3D
- Affected
- up to 4.9.4
- What to do
- Affects up to 4.9.4. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WC Vendors Marketplace: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49263 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WCVendors WC Vendors Marketplace wc-vendors allows Blind SQL Injection.This issue affects WC Vendors Marketplace: from n/a through <= 2.5.6.
- Product
- WC Vendors Marketplace
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update WC Vendors Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Sina Extension for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49262 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shaonsina Sina Extension for Elementor sina-extension-for-elementor allows Stored XSS.This issue affects Sina Extension for Elementor: from n/a through <= 3.6.1.
- Product
- Sina Extension for Elementor
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Sina Extension for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Team Showcase: Improper Control of Generation of Code ('Code Injection')CVE-2025-49250 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Control of Generation of Code ('Code Injection') vulnerability in cmoreira Team Showcase team-showcase-cm allows Code Injection.This issue affects Team Showcase: from n/a through < 25.05.13.
- Product
- Team Showcase
- What to do
- Update Team Showcase to the newest version.
Jun 6, 2025Team Showcase: Missing AuthorizationCVE-2025-49248 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cmoreira Team Showcase team-showcase-cm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Showcase: from n/a through < 25.05.13.
- Product
- Team Showcase
- What to do
- Update Team Showcase to the newest version.
Jun 6, 2025Testimonials Showcase: Missing AuthorizationCVE-2025-49246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.
- Product
- Testimonials Showcase
- Affected
- up to 1.9.16
- What to do
- Affects up to 1.9.16. Update Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Shortcodes Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49244 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vova Shortcodes Ultimate shortcodes-ultimate allows Stored XSS.This issue affects Shortcodes Ultimate: from n/a through <= 7.3.5.
- Product
- Shortcodes Ultimate
- Affected
- up to 7.3.5
- What to do
- Affects up to 7.3.5. Update Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025ShiftNav – Responsive Mobile Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49243 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-responsive-mobile-menu allows Stored XSS.This issue affects ShiftNav – Responsive Mobile Menu: from n/a through <= 1.8.
- Product
- ShiftNav – Responsive Mobile Menu
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update ShiftNav – Responsive Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Bellows Accordion Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu allows Stored XSS.This issue affects Bellows Accordion Menu: from n/a through <= 1.4.3.
- Product
- Bellows Accordion Menu
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Bellows Accordion Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025oik: Missing AuthorizationCVE-2025-49241 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in bobbingwide oik oik allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects oik: from n/a through <= 4.15.1.
- Product
- oik
- Affected
- up to 4.15.1
- What to do
- Affects up to 4.15.1. Update oik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025DocsPress: Missing AuthorizationCVE-2025-49240 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in nK DocsPress docspress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DocsPress: from n/a through <= 2.5.2.
- Product
- DocsPress
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update DocsPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Print Invoice & Delivery Notes for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-49239 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.5.0.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Everest Backup: Cross-Site Request Forgery (CSRF)CVE-2025-49238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Cross Site Request Forgery.This issue affects Everest Backup: from n/a through <= 2.3.3.
- Product
- Everest Backup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025POEditor: Cross-Site Request Forgery (CSRF)CVE-2025-49237 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in POEditor POEditor poeditor allows Path Traversal.This issue affects POEditor: from n/a through <= 0.9.10.
- Product
- POEditor
- Affected
- up to 0.9.10
- What to do
- Affects up to 0.9.10. Update POEditor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Raychat: Missing AuthorizationCVE-2025-49236 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raychat Raychat raychat allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Raychat: from n/a through <= 2.1.0.
- Product
- Raychat
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Raychat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025RTMKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49235 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through <= 1.6.0.
- Product
- RTMKit
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Sweet Dessert: Deserialization of Untrusted DataCVE-2025-49073 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Sweet Dessert sweet-dessert allows Object Injection.This issue affects Sweet Dessert: from n/a through < 1.1.13.
- Product
- Sweet Dessert
- Fixed in
- 1.1.13
- What to do
- Update Sweet Dessert to 1.1.13 or newer.
Jun 6, 2025Mr. Murphy: Deserialization of Untrusted DataCVE-2025-49072 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Mr. Murphy mr-murphy allows Object Injection.This issue affects Mr. Murphy: from n/a through < 1.2.12.1.
- Product
- Mr. Murphy
- What to do
- Update Mr. Murphy to the newest version.
Jun 6, 2025Image Hover Effects Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksera Image Hover Effects Block image-hover-effects-block allows Stored XSS.This issue affects Image Hover Effects Block: from n/a through <= 1.4.5.
- Product
- Image Hover Effects Block
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Image Hover Effects Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Payment QR WooCommerce: Missing AuthorizationCVE-2025-31000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Miguel Fuentes Payment QR WooCommerce payment-qr-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment QR WooCommerce: from n/a through <= 1.1.6.
- Product
- Payment QR WooCommerce
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Payment QR WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025External Store for Shopify: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30999 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fahad Mahmood External Store for Shopify wp-shopify allows PHP Local File Inclusion.This issue affects External Store for Shopify: from n/a through <= 1.5.9.
- Product
- External Store for Shopify
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update External Store for Shopify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Car Repair Services: Server-Side Request Forgery (SSRF)CVE-2025-30997 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Car Repair Services car-repair-services allows Server Side Request Forgery.This issue affects Car Repair Services: from n/a through <= 5.0.
- Product
- Car Repair Services
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update Car Repair Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Widgetize Pages Light: Cross-Site Request Forgery (CSRF)CVE-2025-30995 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
- Product
- Widgetize Pages Light
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Widgetize Pages Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025CubeWP: Cross-Site Request Forgery (CSRF)CVE-2025-30994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Cross Site Request Forgery.This issue affects CubeWP: from n/a through <= 1.1.29.
- Product
- CubeWP
- Affected
- up to 1.1.29
- What to do
- Affects up to 1.1.29. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WPDM – Premium Packages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Stored XSS.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.6.
- Product
- WPDM – Premium Packages
- Affected
- up to 6.0.6
- What to do
- Affects up to 6.0.6. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025ThemeHunk: Missing AuthorizationCVE-2025-30990 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeHunk: from n/a through <= 1.2.0.
- Product
- ThemeHunk
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update ThemeHunk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.